bafybeignqbqcj3ivss4hhm4rqyiiif25p5n32yh7iqzmhpf4aqaa2sxgha[.]ipfs[.]dweb[.]link

This domain is flagged as an elevated-risk brand impersonation threat targeting Discord users. Analysis indicates the site masqueraded as Tatsumeeko, a fantasy RPG for Discord and mobile platforms, likely to deceive users into engaging with fraudulent content or disclosing credentials. The impersonation tactic aligns with common social engineering techniques used to exploit trust in established brands, particularly in gaming and communication platforms. Infrastructure analysis reveals the domain was registered through CSC Corporate Domains, Inc. on February 24, 2017, though malicious activity was detected more recently. It resolves to IP address 209.94.90.3 and employs technologies including Contentful, IPFS, Ant Design, Cloudflare, and HTTP/3. The domain is currently offline but was previously flagged by 12 out of 95 security vendors on VirusTotal. It appears on two security blocklists (PhishDestroy and ScamSniffer) and holds a Gridinsoft trust score of 0/100. The SSL certificate is issued by Let's Encrypt, a common choice for both legitimate and malicious domains. Mitigation steps for this brand impersonation threat include blocking the domain and associated IP address (209.94.90.3) at the network level. Organizations should update security blocklists to include this domain and monitor for any re-emergence or similar impersonation attempts targeting Discord or related gaming platforms. End users should be educated on verifying domain authenticity before interacting with links or downloading content, particularly those promoting Discord-integrated applications. Security teams are advised to review logs for prior connections to this domain and investigate any potential credential exposure or unauthorized access resulting from this campaign.