bafybeialhrwzqxqwwecyjmub6gn4ehoajt64dcpsaxtu6b5ier4zowx3de[.]ipfs[.]dweb[.]link

The domain bafybeialhrwzqxqwwecyjmub6gn4ehoajt64dcpsaxtu6b5ier4zowx3de.ipfs.dweb.link was observed on July 24, 2026 as an active generic phishing infrastructure. The site returns HTTP 200 and presents a page title identical to its IPFS hash path (/ipfs/bafybeialhrwzqxqwwecyjmub6gn4ehoajt64dcpsaxtu6b5ier4zowx3de/), indicating that the content is served directly from the InterPlanetary File System. The domain was registered on 24 February 2017 through CSC Corporate Domains, Inc., and is protected by a Let’s Encrypt certificate issued by the E7 authority. DNS resolution points to 209.94.90.2, an address owned by Protocol Labs (AS40680) located in the United States, and the authoritative nameservers are clarissa.ns.cloudflare.com and tate.ns.cloudflare.com, confirming Cloudflare front‑end services with HTTP/3 support.

Reputation metrics are extremely low: Gridinsoft assigns a trust score of 0 / 100, Scamadviser a score of 1 / 100, and the domain appears on a single security blocklist, specifically PhishDestroy, which has already blocked the site. VirusTotal analysis shows that 17 of 95 scanned security vendors flagged the domain, reinforcing the malicious classification. No additional intelligence such as brand targeting, specific payloads, or observed victim interactions is currently available, leaving the exact phishing lure undefined.

Defenders should block DNS resolution to 209.94.90.2, enforce URL filtering for the full domain string, and monitor traffic for HTTP/3 connections to Cloudflare‑managed endpoints that resolve to this IP. Given the low trust scores and existing blocklist entry, the domain should be treated as high‑risk and added to internal deny lists. Continuous re‑scanning on VirusTotal and periodic WHOIS checks are recommended to capture any changes in registration or certificate details.