bafybeig2qxervlifeg5gur3hrsbgo6hrco4esjxaz2r6nixoqkc6nhhjbe[.]ipfs[.]dweb[.]link

This domain, hosted on an IPFS decentralized gateway (bafybeig2qxervlifeg5gur3hrsbgo6hrco4esjxaz2r6nixoqkc6nhhjbe.ipfs.dweb.link), is currently under investigation for generic phishing activity. Analysis indicates the domain was registered on February 24, 2017, and resolves to 209.94.90.2, an IP address associated with AS40680 (Protocol Labs) in the United States. The site presents a page title of 'Pencils Protocol,' though the exact nature of the phishing content remains unconfirmed due to limited technical analysis of the page itself. Infrastructure review reveals the use of Cloudflare nameservers (clarissa.ns.cloudflare.com, tate.ns.cloudflare.com) and HTTP/3, alongside a Let's Encrypt SSL certificate (E7). The domain returns an HTTP 301 redirect status, which may indicate an attempt to funnel traffic to another endpoint. Two security blocklists have flagged this domain, and it holds a Scamadviser trust score of 1/100, suggesting low legitimacy. While no detections were recorded in recent scans by security vendors, the absence of detections does not confirm safety. Defenders should treat this domain as potentially malicious until further analysis is completed. Monitoring for redirects, reviewing SSL certificate transparency logs, and blocking the domain at the network level are recommended actions. Additional investigation into the 'Pencils Protocol' branding and any associated wallet addresses or credential harvesting mechanisms is advised.