bafybeidtnckzvkdfd4adyg7s3vhgnsxy3sxyvceyaty6bcbuxmmlfvut3a[.]ipfs[.]dweb[.]link

Analysis of the domain bafybeidtnckzvkdfd4adyg7s3vhgnsxy3sxyvceyaty6bcbuxmmlfvut3a.ipfs.dweb.link indicates an elevated‑risk brand impersonation campaign targeting the Pendle brand. The site was hosted on an IP address owned by AS40680 (Protocol Labs) located in the United States and resolved to 209.94.90.2. Registration records show the domain was created on February 24, 2017 and is registered through CSC Corporate Domains, Inc. The TLS certificate is issued by Let’s Encrypt (E7), confirming the use of a valid, publicly trusted certificate. Cloudflare services are present, as evidenced by the nameservers clarissa.ns.cloudflare.com and tate.ns.cloudflare.com, and the site supported HTTP/3.

The page title returned by the server is "Pendle," matching the advertised brand target. HTTP responses indicate the resource now returns a 410 Gone status, and the domain is reported as taken offline. VirusTotal scans show eight of ninety‑five security vendors flagged the domain, and it appears on two independent blocklists, specifically PhishDestroy and ScamSniffer. The overall risk assessment is elevated due to the combination of brand impersonation, a reputable SSL certificate, and the use of a well‑known CDN that can obscure the true origin of malicious traffic.

Uncertainties remain regarding the exact content that was served before takedown, the presence of any malicious payloads, and whether additional infrastructure (e.g., command‑and‑control servers) was associated with this domain. Defenders should continue to block the domain at perimeter controls, monitor for any future re‑registration attempts, and add the associated IP address and name servers to deny lists. Network telemetry should be inspected for historic connections to 209.94.90.2, and any endpoints that may have accessed the site should be examined for potential credential compromise or malware infection.