bafybeiddfzec3ssadmq4s7m7fotcrv2543fgmtp5fhndlmktya2zv4jvyy[.]ipfs[.]dweb[.]link

This domain, hosted on the InterPlanetary File System via dweb.link, is actively flagged as a high-risk phishing threat targeting financial services. The page title, 'Spiko | The first Money Market Funds on your wallet,' suggests an attempt to deceive users into believing it is a legitimate investment platform. Infrastructure analysis reveals the domain resolves to IP address 209.94.90.3 and employs Cloudflare with HTTP/3 support, a configuration commonly observed in both legitimate and malicious services. The SSL certificate is issued by Let's Encrypt, which does not inherently indicate malicious intent but is frequently used by threat actors due to its accessibility and automation capabilities. Security vendor assessments indicate a notable level of detection, with 13 out of 95 engines on VirusTotal flagging the domain as malicious. Additionally, the domain appears on two security blocklists and is explicitly blocked by at least two anti-phishing tools. The Scamadviser trust score of 1 out of 100 further corroborates its classification as high-risk. While the domain was registered in February 2017 through a corporate registrar, this long registration period does not mitigate its current malicious use, as threat actors often repurpose older domains to evade detection. The exact nature of the phishing mechanism remains unconfirmed, as the site's content has not been fully analyzed. However, the combination of financial-themed branding, low trust scores, and active blocklist presence strongly indicates an intent to harvest credentials or financial information. Defenders should treat this domain as actively malicious and prioritize blocking or monitoring access to it. Network-level protections, such as DNS filtering or IP-based restrictions, are recommended to mitigate exposure. Given the domain's use of decentralized hosting, traditional takedown methods may be less effective, necessitating proactive detection and response measures.