bafybeicdaibqcinsl5c2zhd7jgycr5pefqe3bann36wpwwqi2gmjnbzb6u[.]ipfs[.]dweb[.]link

Analysis indicates that the domain associated with the IPFS content identifier bafybeicdaibqcinsl5c2zhd7jgycr5pefqe3bann36wpwwqi2gmjnbzb6u, accessed via dweb.link, is actively serving a generic phishing threat as of July 12, 2026. The domain resolves to 209.94.90.3, an IP address geolocated in the United States under AS40680 (Protocol Labs), a network frequently utilized for decentralized web hosting. Infrastructure analysis reveals the use of Cloudflare nameservers (clarissa.ns.cloudflare.com and tate.ns.cloudflare.com), which are commonly employed to obfuscate direct hosting origins and enhance resilience against takedown efforts. The domain was registered on February 24, 2017, through CSC Corporate Domains, Inc., a registrar often associated with corporate and high-volume domain registrations. While the registration date precedes the current malicious activity, this is not uncommon in phishing campaigns that repurpose older domains to evade reputation-based filtering. The SSL certificate is issued by Let's Encrypt (serial number E7), providing HTTPS encryption, which may lend an appearance of legitimacy to unsuspecting users. Detection metrics indicate that the domain is flagged by two security blocklists (PhishDestroy and PhishingDB) and has been assigned a trust score of 0/100 by Gridinsoft and 1/100 by Scamadviser, reflecting a high level of consensus regarding its malicious nature. Seventeen of ninety-five security vendors on a widely used threat intelligence platform have classified this domain as malicious, further corroborating its status as a phishing threat. The HTTP status code 200 confirms that the page is currently accessible, and no evidence suggests that the content has been removed or disabled. The exact nature of the phishing content remains unconfirmed, as the page title (/ipfs/bafybeicdaibqcinsl5c2zhd7jgycr5pefqe3bann36wpwwqi2gmjnbzb6u/) does not reveal a specific brand or service being targeted.