IPFS as abuse infrastructure: phishing, malware and how to detect it

Published by 0data · Threats · 19 min read

IPFS promised a web that does not go down: content lives on many nodes and is requested by what it is, not where it is. What the sources have documented since 2019 is that attackers mostly use it as a place to host what is hard to remove: phishing kits and malware payloads, served through HTTPS gateways. This article gathers what Cisco Talos, Palo Alto Unit 42, Kaspersky, Trustwave, SANS and academic research up to August 2026 say, dispels the anonymity myth with IPFS’s own documentation and explains how to detect it and how to respond, with patterns, commands and a script you can run today.

10,489

phishing CIDs detected in 11 months (study at The Web Conference 2026)

573 of 588

gateways involved were not on public gateway lists (same study: a fixed list is not enough)

< 20%

of flagged content filtered by public gateways not run by Protocol Labs (USENIX Security 2024)

13.1%

of the phishing links on cloud and decentralized platforms that Kaspersky blocked went to two IPFS gateways (dweb.link 7.8% + ipfs.io 5.3% (our sum), August 2026 report)

Each figure comes from a different source and measures something different (CIDs, gateways, filtered content, traffic): they are not comparable with each other.

The short answer

• IPFS is not anonymous. According to its official documentation, the metadata nodes publish to the DHT is public, and a lookup on a PeerID can lead to the IP, especially if the node usually runs from the same place.
• What is documented is mostly hosting: phishing kits and malware payloads (Talos, Unit 42, Trustwave). The best-documented case of command and control over IPFS’s own network is IPStorm, from 2019.
• The control point is the gateways. Cloudflare explained it cannot delete content, only disable access through its gateway; and filtering across gateways is very uneven.
• Blocking one gateway is not enough. Talos observed attackers switch gateway when one is blocked, and the 2026 study found 573 gateways outside public lists.
• The padlock does not help: phishing is served with the gateway’s certificate and reputation, and Kaspersky (August 2026) considers the padlock and reputation lists insufficient for this kind of hosting.
• Detect the pattern, not the indicator: SANS recommends limiting access with DNS or URL filtering, and Kaspersky notes anti-spam blocks these links like any other phishing.

What the sources say, 2019 to 2026

The IPFS-focused vendor volume series (Trustwave, Kaspersky, SANS) are from 2022 to 2024. For 2025 and 2026, the most recent quantitative sources we have found are the April 2026 academic study and Kaspersky’s August 2026 report, which is not IPFS-specific but includes two of its gateways among the most abused platforms; we have not found a vendor report devoted only to IPFS in those years.

IPFS in five minutes

IPFS (InterPlanetary File System) is a protocol to store and distribute content between peers. Instead of requesting a file from a specific server (https://server/path), you request it by its cryptographic fingerprint: the CID (Content Identifier). Anyone who holds that content can serve it, and whoever receives it computes the hash to check it has not changed.

A gateway accepts two URL forms: path, https://gateway/ipfs/<CID>/file, and subdomain, https://<CID>.ipfs.gateway/file. According to the IPFS documentation, the path gateway does not provide origin isolation and should not be used to host web apps, while the subdomain gateway does.

Four myths worth dispelling

Why attackers use it, according to the sources

Hard to remove Taking it down in one place does not delete it

Trustwave noted that even if content is removed on one node it may remain available on others. Cloudflare explained it cannot delete anything: it only disables access through its own gateway. Kaspersky observed IPFS URLs that first appeared in October 2022 and were still operational when it published its report in March 2023.

Borrowed reputation Served from a well-known gateway

The 2026 study describes criminals relying on gateways’ reputation to avoid detection and on gateway caching to extend how long content stays online.

Many URLs One content, many addresses

Cofense noted that any CID and gateway combination reaches the same content, so blocking one URL does not remove it. Talos observed attackers switch gateway when one is blocked.

Hosting and market Services that help

Trustwave cited the abuse of Infura, nft.storage and Filebase. Unit 42 saw actors sell IPFS-hosted scam services advertising that sites are not suspended for a long time.

What IPFS does not give them. According to Trend Micro, all the phishing pages it analyzed send the stolen data to ordinary web servers: what is hosted on IPFS is the page, not the credential capture. And the identity of the node publishing the content is public, as the documentation itself acknowledges. That is why phishing on IPFS can be detected and cut; what does not work is trusting the domain’s reputation.

Phishing on IPFS: anatomy of an attack

1. 1. Publish
   The attacker adds the kit (an HTML page with a brand’s fake login) to a node of their own or to a pinning service and gets a CID.
2. 2. Serve
   Any public gateway delivers it over HTTPS: https://gateway/ipfs/<CID>. The victim sees the gateway’s domain and its padlock.
3. 3. Lure
   Documented cases include fake Outlook sign-in pages (Trustwave), a Microsoft-themed page served by Cloudflare’s gateway (Cofense), fake DocuSign emails with an invoice (ThreatDown) and attacks aimed at companies’ procurement departments (Kaspersky).
4. 4. Capture
   The page sends the credentials to an external web server: according to Trend Micro, all the pages it analyzed did so.
5. 5. Reuse
   The credentials give access to the victim’s mail or cloud. If the kit is taken down, the attacker can republish it with a minimal change and therefore another CID.

What the numbers say

Kaspersky measured the volume of phishing emails with IPFS links between November 2022 and February 2023. In the report itself: in late 2022 there were quiet days of a few hundred emails and busy days of up to 15,000; in January and February there were surges of more than 24,000 a day, with peaks of 34,000 to 37,000, and February was the busiest month, with almost 400,000. That is a historical series; the most recent we have found is the 2026 study, which counted 10,489 phishing CIDs in 11 months, grouped into 448 clusters.

Phishing emails with IPFS links that Kaspersky registered per day. Source: Securelist, March 27, 2023. These are the extremes the report’s text cites, not a continuous series; the surge died down by mid-February, with figures returning to November and December levels.

What the victim sees Everything looks normal

• A well-known gateway domain
• A valid HTTPS padlock
• A page identical to a real login
• No certificate error

What the defender sees There are patterns

• A /ipfs/<CID> path or a <CID>.ipfs. subdomain
• A different CID in every campaign
• A form that posts to a domain that is not the gateway’s
• A gateway almost nobody at your company uses

The stable indicator is not the CID but the pattern.

IPFS as malware and C2 infrastructure

Here it pays to be precise about what is documented.

IPStorm, 2019 A botnet on the IPFS network

Anomali described malware with its own P2P network over libp2p: it uses PubSub with two topics, “info” and “cmd”, and the DHT to find peers. Because it blends in with legitimate nodes, dismantling it without taking down the legitimate network was hard. Its size depended on who measured it: Bitdefender estimated about 9,000 devices in 2020, almost all Android, and Anomali went from about 3,000 systems in May 2019 to more than 13,500. In 2023 the Department of Justice announced the dismantling of its infrastructure and the guilty plea of its operator.

Hosted payloads, 2022 Malware served from IPFS

Talos found Agent Tesla, a data wiper, the Hannabi Grabber infostealer and reverse shells hosted on IPFS, and noted that the binaries of Dark Utilities, a command-and-control framework, were served from IPFS.

Families, 2023 Delivery, command and staging

Unit 42 listed OriginLogger, XLoader, XMRig, Metasploit, IPStorm and Dark Utilities among the families and tools that used IPFS for delivery, command and control or staging.

Malware cases documented by the sources in the table above.

What we have not found in the sources reviewed are 2024 to 2026 reports of new botnets using the IPFS network as a command channel: what is documented in those years is mostly phishing. The defensive consequence does not change: IPFS can no longer be treated as just another domain you block and forget; you have to know what your company really uses and watch the rest.

The defender’s advantage: attribution

The flip side of the “anonymity” that does not exist: whoever offers a CID shows up in the DHT. Kubo’s troubleshooting guide documents how to ask who announces a piece of content and which addresses that node answers on.

# Who offers this CID (Kubo; in older versions: ipfs dht findprovs)
ipfs routing findprovs <CID>

# Network addresses of one of those peers
ipfs routing findpeer <PeerID>

• Do it from isolated infrastructure. DHT queries are public, and your node announces itself on the network.
• Do not download the content on corporate machines. Use a disposable sandbox to analyze it.
• The providers are not always the attacker. They may be a pinning service or a gateway: they are your abuse contact. A 2025 study asks, precisely, whether pinning services apply “know your customer” practices that allow attribution.
• An IP is not a person. It may be a VPS, a relay or a compromised machine. It is a lead, not an identification.
• Check with your legal counsel before interacting with criminal infrastructure beyond observing public metadata.

How to detect it

Two sources set the tone. SANS recommends limiting users’ access to IPFS content with DNS or URL filtering, and notes that blocking it entirely would likely have little business impact. Cofense recommends treating any user access to a gateway as a potential security event. And the 2026 study warns that a fixed list of gateways is not enough.

Log search patterns

Two expressions for grep -E over proxy logs. The first finds path gateways with a well-formed CID; the second, subdomain gateways:

# Path gateways (CID v0 and v1 with SHA-256)
grep -E '/ip[fn]s/(Qm[1-9A-HJ-NP-Za-km-z]{44}|b[a-z2-7]{58})' proxy.log

# Subdomain gateways
grep -E 'https?://b[a-z2-7]{58}\.ip[fn]s\.' proxy.log

And an example rule for Squid. The domain list is only a starting point (Cloudflare announced its domains would stop working on August 14, 2024, and the 2026 study found hundreds of gateways outside public lists), and the path rule only works if the proxy inspects HTTPS traffic; without inspection you can only filter by domain. Place it before the rules that allow traffic:

acl gateways_ipfs dstdomain .ipfs.io .dweb.link
acl ruta_ipfs urlpath_regex -i ^/ip[fn]s/
http_access deny gateways_ipfs
http_access deny ruta_ipfs

A script to extract and validate CIDs

This script (Python 3, no dependencies) reads text from standard input, whether a proxy log, an email or a DNS export, and extracts IPFS gateway URLs and CIDs, checking that each CID is structurally valid. Use it like this: cat proxy.log | python3 ipfs_ioc.py.

#!/usr/bin/env python3
"""Extrae de un texto (log de proxy, correo, DNS) las URLs de gateways IPFS
y los CID que contienen, y valida que cada CID sea estructuralmente correcto."""
from __future__ import annotations

import base64
import json
import re
import sys
from collections import Counter
from dataclasses import asdict, dataclass

B58 = "123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz"
PATH_RE = re.compile(r"https?://(?P<host>[A-Za-z0-9.-]+)(?::\d+)?/(?P<ns>ipfs|ipns)/(?P<id>[A-Za-z0-9._-]+)")
SUB_RE = re.compile(r"https?://(?P<id>[a-z0-9]{46,})\.(?P<ns>ipfs|ipns)\.(?P<host>[A-Za-z0-9.-]+)")
CID_RE = re.compile(r"\b(?:Qm[1-9A-HJ-NP-Za-km-z]{44}|b[a-z2-7]{58})\b")


@dataclass(frozen=True)
class Hallazgo:
    gateway: str   # dominio del gateway ("" si es un CID suelto)
    estilo: str    # "ruta", "subdominio" o "suelto"
    espacio: str   # "ipfs" o "ipns"
    id: str
    cid: str       # "v0", "v1" o "" si no es un CID válido (p. ej. un nombre IPNS)


def tipo_cid(texto: str) -> str:
    """Devuelve 'v0' o 'v1' si `texto` es un CID con multihash SHA-256; si no, ''."""
    try:
        if texto.startswith("Qm") and len(texto) == 46:
            n = 0
            for c in texto:
                n = n * 58 + B58.index(c)
            crudo = n.to_bytes(34, "big")
            return "v0" if crudo[:2] == b"\x12\x20" else ""
        if texto.startswith("b") and len(texto) == 59:
            cuerpo = texto[1:].upper()
            crudo = base64.b32decode(cuerpo + "=" * (-len(cuerpo) % 8))
            return "v1" if len(crudo) == 36 and crudo[0] == 1 and crudo[2:4] == b"\x12\x20" else ""
    except (ValueError, OverflowError):
        pass
    return ""


def analizar(texto: str) -> list[Hallazgo]:
    vistos: set[Hallazgo] = set()
    for m in PATH_RE.finditer(texto):
        vistos.add(Hallazgo(m["host"].lower(), "ruta", m["ns"], m["id"], tipo_cid(m["id"])))
    for m in SUB_RE.finditer(texto):
        vistos.add(Hallazgo(m["host"].lower(), "subdominio", m["ns"], m["id"], tipo_cid(m["id"])))
    ya = {h.id for h in vistos}
    for m in CID_RE.finditer(texto):
        if m[0] not in ya and tipo_cid(m[0]):
            vistos.add(Hallazgo("", "suelto", "ipfs", m[0], tipo_cid(m[0])))
    return sorted(vistos, key=lambda h: (h.gateway, h.id))


def main() -> None:
    hallazgos = analizar(sys.stdin.read())
    print(json.dumps({
        "por_gateway": Counter(h.gateway for h in hallazgos if h.gateway),
        "hallazgos": [asdict(h) for h in hallazgos],
    }, indent=2, ensure_ascii=False))


if __name__ == "__main__":
    main()

In the output, an empty cid means the identifier is not a valid CID (for example, an IPNS name or a malformed path). Count gateways by frequency and compare with what your company really uses: the odd ones tend to be in the tail.

How to respond

1. 1. Preserve
   Keep the URL, CID, gateway, time and headers. Get a copy of the HTML in a sandbox and compute its SHA-256 hash.
2. 2. Contain
   Block the URL and CID on the proxy and in email. For whoever entered data, change their credentials and revoke their sessions.
3. 3. Report to more than one operator
   Send an abuse report to the gateway operator, to the provider’s pinning service (the one findprovs shows) and to the exfiltration destination. The 2024 USENIX study showed that only Protocol Labs’ gateways filter the whole blocklist, so a single report is not enough.
4. 4. Cut the exfiltration
   Block the domain or bot receiving the data. It can be a more stable indicator than the CID: the kit changes URL, but the exfiltration destination may not.
5. 5. Hunt variants
   Look for the template (resources, texts, endpoint), not the CID.
6. 6. Close
   Inform affected users, review access and, if you have legitimate Web3 use, move to an allowlist.

If you run a node or a gateway, Kubo includes support for denylists in the IPIP-383 format, although the official build ships with none enabled by default.

What to do by profile

What not to do

• Block everything without an inventory. If you have legitimate Web3 apps, you break services; first look at what they use.
• Open the CID from a corporate machine to “see what it is”.
• Download the payload outside a sandbox, or connect your research node to the company network.
• Hack back. Attacking whoever hosts or queries the content can carry legal liability.

Beyond IPFS

The pattern repeats in any P2P or content-addressed network, and so does the defensive approach: inventory what is really used, watch the usage pattern and do not rely on a domain’s reputation. Veilid, the P2P privacy framework Cult of the Dead Cow presented at DEF CON 31 (August 2023) and its authors describe as “like Tor, but for apps”, is an example of technology to watch closely: allowing privacy and resilience does not make it malicious, but it does change what you can block.

What we know and what we don’t

Limits of this analysis. Each source measures something different (emails, CIDs, traffic, reports) over different periods, so their figures cannot be added up or compared. The IPFS-focused vendor series are from 2022 to 2024; the most recent we have found are the April 2026 academic study and Kaspersky’s August 2026 report, the latter not IPFS-specific. We do not yet have a QuantumSec series of our own, and this article does not measure how many current campaigns use IPFS. Public gateways change: Cloudflare announced in 2024 that it would stop running its own, so check which ones are still active. The commands are from Kubo, and their names change between versions (ipfs dht became ipfs routing).

Checklist for this week

• Check whether your company uses IPFS or Web3. If not, block public gateways and alert on attempts.
• Search your proxy logs for the last 30 days for the /ipfs/ and .ipfs. patterns.
• Run the script on that result and count the gateways.
• Look for ipfs processes and listeners on port 4001 on servers and workstations.
• Add the abuse contacts of more than one gateway and of the pinning service to your phishing response guide.
• Include this pattern in your next phishing simulation.
• Every six months, check which gateways are still operating.

Frequently asked questions

Is it illegal to use IPFS?

No. It is a legitimate protocol with legitimate uses. What is pursued is the abuse: hosting phishing, malware or command-and-control infrastructure.

Is IPFS anonymous?

Not by default. The official documentation says the metadata nodes publish to the DHT is public and that a lookup on a PeerID can lead to the IP. Anonymity, if you want it, has to be built on top.

How much phishing is there on IPFS today?

We have no series of our own. The 2026 academic study counted 10,489 phishing CIDs in 11 months, and Kaspersky’s August 2026 report included dweb.link (7.8%) and ipfs.io (5.3%), two IPFS gateways, among the ten platforms with the most phishing links. Each source measures something different.

What happened to Cloudflare’s gateway?

Cloudflare announced in 2024 that it would stop running its public IPFS gateways. The cloudflare-ipfs.com and cf-ipfs.com domains redirected to ipfs.io and dweb.link until August 14, 2024.

Should I block IPFS in my company?

If you do not use it, blocking public gateways and alerting on attempts is reasonable and cheap; SANS notes that blocking it entirely would likely have little business impact. If you do use it, an allowlist per application and alerts for the rest is better.

Can content be deleted from IPFS?

There is no global delete. Access can be removed from gateways and pinning services that cooperate, but the content stays available while any node stores it.

Is the CID useful as an indicator of compromise?

It works for that specific variant. Since changing one byte produces another CID, it is better to detect the template, the URL pattern and the exfiltration endpoint.

Next step

At QuantumSec we work on threat intelligence and detecting infrastructure abuse. If you want to review how your company behaves against this pattern, let’s talk about threat intelligence or simulate a realistic phishing with social engineering. What we publish every week is in our weekly threat landscape (available in Spanish), generated with 0data.

Related service

threat intelligence (CTI)

Topics

#IPFS #Web3 #Phishing #Malware #C2 #Threat-intelligence #Threat-hunting #0data

Keep reading

• A badly scoped pentest isn't cheap: it's useless
• Bybit Hack Analysis (III): Implications and the Future of Crypto Security After the Bybit Hack
• How to Share Credentials and Encrypted Files Securely with Third Parties

Sources

• Kaspersky: press release “Scammers go interplanetary” (March 2023)
• Trustwave SpiderLabs: IPFS, the new hotbed of phishing (July 2022)
• Cisco Talos: cybercriminal adoption of IPFS for phishing and malware campaigns (November 2022)
• Palo Alto Unit 42: threat actors rapidly adopt Web3 IPFS technology (April 2023)
• Anomali: IPStorm, new malware using the IPFS P2P network (2019)
• Bitdefender: Looking into the eye of the Interplanetary Storm (2020)
• US Department of Justice: IPStorm operator pleads guilty (2023)
• Securelist (Kaspersky): use of IPFS in mass and targeted phishing campaigns (2023)
• Securelist (Kaspersky): phishers are hijacking legitimate cloud infrastructure (August 2026)
• Trend Micro: IPFS, a new data frontier or a new cybercriminal hideout?
• Cofense: IPFS abuse continues as attackers mix and match techniques
• SANS ISC: increase in phishing messages pointing to IPFS and R2 buckets (March 2024)
• Cloudflare: public IPFS gateways and supporting Interplanetary Shipyard (2024)
• TorrentFreak: Cloudflare IPFS takedowns skyrocket (June 2024)
• USENIX Security 2024: content moderation in the InterPlanetary File System
• arXiv 2025: investigating anonymity abuse in IPFS
• The Web Conference 2026: Netting Phish in the IPFS Ocean
• IPFS documentation: privacy and encryption
• IPFS documentation: gateways
• IPFS documentation: DNSLink
• Kubo: troubleshooting guide
• Kubo: content blocking (denylists)
• libp2p: secure channels (TLS 1.3 and Noise)
• Dark Reading: Cult of the Dead Cow’s privacy-first app framework (Veilid)

Tell us what you want to monitor