bafybeiemb5z6so2dakuqswuqwoaoci3ifrulyygkdpoexmtv63lu4qrhai[.]ipfs[.]dweb[.]link

This domain, bafybeiemb5z6so2dakuqswuqwoaoci3ifrulyygkdpoexmtv63lu4qrhai.ipfs.dweb.link, is flagged as a high-risk generic phishing threat. Analysis indicates it was registered on February 24, 2017, and remains active as of July 12, 2026. The domain resolves to the IP address 209.94.90.2 and is currently blocked by at least one security vendor. Infrastructure analysis reveals the use of IPFS, Cloudflare, and HTTP/3 technologies, with a Let's Encrypt SSL certificate in place. The page title, 'IPFS Service Worker Gateway | HEAD@572bc4a,' suggests it may be leveraging decentralized web infrastructure, though the exact phishing mechanism or target remains unconfirmed due to lack of detailed content analysis. VirusTotal reports that 18 out of 95 security vendors have flagged this domain, and it appears on one additional security blocklist. The domain was registered through CSC Corporate Domains, Inc., though no specific brand or kit association is evident from the available data. Defenders should treat this domain as an active phishing threat, particularly given its persistence and use of IPFS, which can complicate takedown efforts. Monitoring for connections to 209.94.90.2 and related domains is recommended, alongside blocking access at the network level where possible. The domain's long-standing registration date does not mitigate its current malicious activity, as phishing operators frequently repurpose older domains for new campaigns.