bafkreicfgt7o5mj3pxbwvosrm5ud2oflyufy3tsw73ruhmubxqtennh6g4[.]ipfs[.]dweb[.]link

The domain bafkreicfgt7o5mj3pxbwvosrm5ud2oflyufy3tsw73ruhmubxqtennh6g4.ipfs.dweb.link was identified as a generic phishing threat, specifically impersonating Adobe Acrobat to trick users into downloading malicious files or revealing credentials. This domain is currently offline, but its recent activity posed a significant risk to unsuspecting visitors. The threat level is elevated, indicating a moderate probability of successful compromise if interacted with.

According to intelligence data, this domain was flagged by 19 out of 95 VirusTotal security vendors, reflecting a notable detection rate. It was registered through CSC Corporate Domains, Inc., and its SSL certificate was issued by Let's Encrypt with serial E7. The domain was created on February 21, 2026, and it resolves to IP address 209.94.90.2. It appears on one security blocklist, and no trust scores were provided, but the combination of recent creation and high vendor flags suggests a malicious intent. The page title observed was "Adobe Acrobat!," which is a clear attempt to deceive users into believing they are accessing legitimate Adobe software.

Given that the domain has been taken offline, the immediate threat is mitigated, but organizations should remain vigilant as similar domains may appear. PhishDestroy recommends blocking all traffic to this domain and its associated IP address at the network level. Users who may have visited the site should scan their systems for malware and change any passwords entered on the page. Continuous monitoring for related domains and IPs is advised, as threat actors often reuse infrastructure. For further details, refer to the full threat report.