bafybeicu6ofsozfl6kqndmqqfliitee75zupzv3ke3jg2ap26vn7lysf6y[.]ipfs[.]dweb[.]link

The domain bafybeicu6ofsozfl6kqndmqqfliitee75zupzv3ke3jg2ap26vn7lysf6y.ipfs.dweb.link was registered through CSC Corporate Domains, Inc. on November 29, 2021 and resolves to the IP address 209.94.90.3, which belongs to AS40680 owned by Protocol Labs in the United States. DNS resolution is served by Cloudflare nameservers clarissa.ns.cloudflare.com and tate.ns.cloudflare.com, and the site presents an HTTP/3-enabled service with a permanent redirect (HTTP 301) to the path /ipfs/bafybeicu6ofsozfl6kqndmqqfliitee75zupzv3ke3jg2ap26vn7lysf6y/. The TLS certificate is issued by Let’s Encrypt (E7). Threat intelligence indicates the domain is currently active and classified as a generic phishing threat with a high risk rating. It appears on two security blocklists—PhishDestroy and PhishingDB—and 16 of 93 VirusTotal scanners have flagged the domain. Reputation metrics are extremely low, with Scamadviser scoring 1/100 and Gridinsoft 0/100. Infrastructure analysis confirms the use of IPFS and Cloudflare services, but the specific content served at the URL has not been publicly disclosed. Defenders should prioritize blocking the domain and its associated IP address, incorporate the observed indicators into detection rules, and continue monitoring for any changes in hosting or content that could expand the threat surface.