bafkreihcem26szdjelsbmieia3awwk23ek6hhpifsxsbu2lgjcdhd4jmaq[.]ipfs[.]dweb[.]link

The domain bafkreihcem26szdjelsbmieia3awwk23ek6hhpifsxsbu2lgjcdhd4jmaq.ipfs.dweb.link is identified as a generic phishing threat with an active status. Analysis indicates this domain is designed to impersonate legitimate services, harvesting user credentials and sensitive information through deceptive web interfaces. No specific brand impersonation has been confirmed, but the infrastructure aligns with credential theft campaigns observed in distributed web environments. Infrastructure analysis reveals the domain was registered through CSC Corporate Domains, Inc. on February 24, 2017, and currently resolves to the IP address 209.94.90.3, hosted on AS40680 (Protocol Labs) in the United States. The SSL certificate is issued by Let's Encrypt (serial E8), a common choice for both legitimate and malicious actors. Detection metrics show the domain is flagged by 20 of 95 security vendors on VirusTotal, with Google Safe Browsing explicitly categorizing it as phishing. The domain appears on one security blocklist and is actively blocked by PhishDestroy, further corroborating its malicious classification. Current status remains active, with no indication of takedown or mitigation at the time of analysis. Organizations and users are advised to implement immediate blocking of this domain at the DNS and network perimeter levels. Security teams should monitor for connections to 209.94.90.3 and review logs for any interaction with the domain, particularly in credential submission contexts. Endpoint protection solutions should be updated to include this domain in phishing detection rules, and user awareness training should emphasize the risks of interacting with distributed web links, even those appearing to use legitimate infrastructure like IPFS gateways.