bafybeih2enmhriyu34h5katuwmktbk34qrl4x5j2dje2irjyn36zy5jkpq[.]ipfs[.]dweb[.]link

The domain bafybeih2enmhriyu34h5katuwmktbk34qrl4x5j2dje2irjyn36zy5jkpq.ipfs.dweb.link is flagged as a high‑risk generic phishing infrastructure. Registration data shows it was created on 24 February 2017 through CSC Corporate Domains, Inc., and the authoritative nameservers are clarissa.ns.cloudflare.com and tate.ns.cloudflare.com, indicating Cloudflare as the DNS provider. Network analysis places the resolved address 209.94.90.3 in the United States under AS40680 (Protocol Labs), a common hosting environment for decentralized web services. The site serves HTTP status code 301 and utilizes HTTP/3, confirming modern protocol support.

TLS termination is provided by a Let’s Encrypt certificate (issuer E7), which validates the domain’s ability to present a valid SSL chain. VirusTotal scans report that 10 of 91 security vendors have flagged the domain, suggesting a non‑trivial detection consensus among malware analysis tools. The page title returned by the HTTP response is "Delta Prime," but no further content has been publicly catalogued.

The domain appears on one external blocklist, specifically PhishDestroy, reinforcing its classification as a phishing resource. Defenders should treat the domain as active and hostile: block the IP address 209.94.90.3 and the full hostname at perimeter and DNS filtering layers, monitor for any new resolution changes, and incorporate the domain into threat‑intel feeds. Ongoing observation is advised because the available intelligence does not disclose the exact payload or victim targeting methodology, leaving the full scope of the phishing campaign uncertain.