bafybeidy6yuusq2pb7qwol7aatrvpt3rixhek5hvo56zei5f6fj76r7pva[.]ipfs[.]dweb[.]link

The domain bafybeidy6yuusq2pb7qwol7aatrvpt3rixhek5hvo56zei5f6fj76r7pva.ipfs.dweb.link is identified as an IPFS-hosted phishing site designed for credential harvesting. Analysis indicates this infrastructure was actively impersonating legitimate services to deceive users into submitting sensitive information. The domain is currently offline, though prior activity suggests it targeted financial or cryptocurrency platforms, a common tactic in IPFS-based phishing campaigns. Infrastructure analysis reveals the domain was flagged by 17 of 95 security vendors on VirusTotal, indicating broad detection across multiple threat intelligence sources. Registered through CSC Corporate Domains, Inc. on February 24, 2017, the domain resolved to the IP address 209.94.90.3 and utilized a Let's Encrypt SSL certificate (serial number E7). It appeared on two security blocklists, further corroborating its malicious classification. The page title, /ipfs/bafybeidy6yuusq2pb7qwol7aatrvpt3rixhek5hvo56zei5f6fj76r7pva/, aligns with IPFS content identifiers, a technique frequently exploited to distribute phishing content due to its decentralized and ephemeral nature. Current status confirms the domain has been taken offline, though residual risks may persist if cached or mirrored versions remain accessible. Organizations are advised to block the domain and associated IP address (209.94.90.3) at the network perimeter. Security teams should monitor for related IPFS hashes or subdomains using the same infrastructure, as threat actors often reuse components across campaigns. End-users should be educated on recognizing IPFS-based phishing attempts, particularly those mimicking login portals or cryptocurrency wallets. Proactive measures include verifying SSL certificates, scrutinizing URL structures, and cross-referencing domains against threat intelligence feeds.