bafkreifv4toarzwlzqzc2cfi34btq6zfvwxnepfkcrap4bjuev5wdcclc4[.]ipfs[.]dweb[.]link

This domain, bafkreifv4toarzwlzqzc2cfi34btq6zfvwxnepfkcrap4bjuev5wdcclc4.ipfs.dweb.link, is flagged as a high-risk generic phishing threat and remains active as of July 12, 2026. Infrastructure analysis reveals the domain is hosted on IPFS and proxied through Cloudflare, resolving to 209.94.90.2 (US, Protocol Labs). The domain was registered in February 2017, though its current malicious use appears more recent. It is served over HTTP/3 with a Let's Encrypt SSL certificate and uses Cloudflare nameservers. The domain is blocked by at least one security vendor and appears on a security blocklist, though the exact content or phishing kit in use has not been confirmed. Defenders should note the HTTP 200 status despite the '400 Bad Request' page title, which may indicate an attempt to evade automated detection or serve malicious content conditionally. The domain's IPFS-based hosting complicates takedown efforts, and its use of Cloudflare may obscure origin details. No specific brand impersonation or scam category has been identified from available data. Immediate blocking at the network level is recommended, along with monitoring for related IPFS hashes or subdomains that may emerge as part of the same campaign.