bafybeidyweyo3gndvyrcyouptypomi5k6lbq2mk6xyke7ce6oot7c2yqni[.]ipfs[.]dweb[.]link

The domain bafybeidyweyo3gndvyrcyouptypomi5k6lbq2mk6xyke7ce6oot7c2yqni.ipfs.dweb.link is currently active and has been classified as a generic phishing threat with a high risk rating. Registration records show the domain was created on 24 February 2017 and is managed through CSC Corporate Domains, Inc. The authoritative nameservers are clarissa.ns.cloudflare.com and tate.ns.cloudflare.com, indicating the use of Cloudflare’s DNS infrastructure. The host resolves to IP address 209.94.90.3, which belongs to AS40680 (Protocol Labs) and is located in the United States. TLS termination is provided by a Let's Encrypt certificate (issuer E7), and HTTP requests receive a 301 redirect response, suggesting the site may forward traffic to another location.

Threat intelligence sources report that six of ninety‑five security vendors on VirusTotal have flagged the domain, and the domain appears on two blocklists, specifically PhishDestroy and ScamSniffer. The Scamadviser trust score is 20 out of 100, reflecting a low reputation. Detected technologies include Cloudflare and HTTP/3, consistent with the observed DNS and networking configuration. While the available data confirms the infrastructure and detection status, no public page title, brand targeting, or specific phishing kit details have been disclosed, leaving the exact content of the hosted page uncertain.

Defenders should prioritize adding the domain to web‑filter block lists, enforce DNS sink‑hole rules for the resolved IP, and monitor for any new indicators such as changes in certificate issuance or additional vendor detections. Continuous re‑scanning with multi‑engine services is recommended to capture any evolution of the payload. The combination of a long‑standing domain, low trust score, active blocklist entries, and multiple vendor detections warrants heightened vigilance for any traffic directed to this address.