From Blocking to Detecting: Securing the New Internet Frontier

This report analyzes an emerging class of phishing campaigns that exploit Web3 infrastructure — storing phishing pages on decentralized networks (primarily IPFS), mapping them to ENS domains, and serving them to regular browsers via public gateways like ipfs.io and eth.link — creating takedown-resistant, multi-domain distribution of identical malicious content; it presents empirical data (protocol/gateway usage and top content hashes), demonstrates operational techniques, and recommends shifting defenses from URL/domain blocking to content- and behavior-based detection.