bafybeihj3zbaoidqg3cnaolz6v7im45zqz4q7wuxzepq5xid72xeotioua[.]ipfs[.]dweb[.]link

This domain is flagged as an active generic phishing threat hosted on the InterPlanetary File System (IPFS) gateway dweb.link. Analysis indicates the page title 'Layer3 – A new layer of possibilities' suggests an attempt to impersonate a legitimate platform, though the exact content and target brand remain unconfirmed without further forensic review. The domain resolves to IP address 209.94.90.3 and was registered on February 24, 2017, through a corporate registrar, with no recent changes to its registration details. Infrastructure analysis reveals the use of Cloudflare and HTTP/3, which may complicate takedown efforts and obscure origin server details. Security vendors have detected malicious activity associated with this domain, with 14 out of 95 engines on VirusTotal flagging it as harmful. The domain appears on two security blocklists and is actively blocked by at least two anti-phishing tools. A Scamadviser trust score of 1/100 further supports the high-risk classification, though this metric alone does not confirm malicious intent. The SSL certificate issued by Let’s Encrypt is valid and does not indicate compromise, but its presence is standard for both legitimate and phishing sites. What remains uncertain is the specific phishing mechanism employed, such as whether the site harvests credentials, distributes malware, or redirects users to external fraudulent pages. The use of IPFS may allow the content to persist even if the gateway domain is blocked, requiring defenders to monitor both the gateway and the underlying content identifier. Defenders should treat this domain as high-risk and consider blocking it at the network level, particularly in environments where Layer3 or similar platforms are relevant. Further analysis of the page’s JavaScript, network requests, and backend infrastructure is recommended to determine the full scope of the threat and identify any linked campaigns.