bafybeibkhz4elzra2dauacvdzm6x2j5t3ow2n2z6ki6pftcjuis6ozi56e[.]ipfs[.]dweb[.]link

This domain, bafybeibkhz4elzra2dauacvdzm6x2j5t3ow2n2z6ki6pftcjuis6ozi56e.ipfs.dweb.link, is flagged as a high-risk brand impersonation threat targeting Coinbase users. Registered on February 24, 2017, through CSC Corporate Domains, Inc., the domain remains active and is hosted on infrastructure associated with Protocol Labs (AS40680) in the United States, resolving to IP address 209.94.90.3. Cloudflare nameservers (clarissa.ns.cloudflare.com and tate.ns.cloudflare.com) are in use, alongside an SSL certificate issued by Let's Encrypt (serial E7). The page title, 'Renzo,' does not align with the identified brand target, Coinbase, suggesting either a secondary payload or a decoy interface. Infrastructure analysis reveals the use of IPFS and HTTP/3, technologies commonly leveraged to obscure hosting origins and complicate takedown efforts. The domain is blocked by three security vendors: PhishDestroy, ScamSniffer, and Enkrypt, and is listed on three blocklists. Fifteen of 95 security vendors on VirusTotal detect this domain as malicious. The scam type is classified as a crypto scam, though the exact mechanics—whether credential harvesting, wallet-draining, or fraudulent token distribution—remain unconfirmed due to limited visibility into the site's content. Defenders should treat this domain as actively malicious, particularly in environments where Coinbase or cryptocurrency-related services are accessed. The combination of brand impersonation, IPFS hosting, and Cloudflare obfuscation indicates a deliberate attempt to evade detection and prolong operational lifespan. Network-level blocking of the domain and its resolving IP (209.94.90.3) is recommended, alongside monitoring for related infrastructure using the same ASN or nameserver patterns. Further analysis of the site's payload is necessary to determine the full scope of the threat.