Tactic or Technique: IPFS

Attackers use IPFS, the InterPlanetary File System, to host phishing pages, malware, and other malicious content in a way that’s difficult to take down. Unlike traditional hosting, IPFS is decentralized, so content is distributed across many nodes instead of sitting on a single server.

A phishing email may include a link that appears to lead to a legitimate website but actually points to an IPFS gateway. Blocking one gateway isn’t enough—the content stays live as long as it’s being shared, and can be accessed through any public node. Each file has a unique identifier, making it easy for attackers to keep it online and hard for defenders to remove.

This tactic gives attackers persistence and reach. Security tools that rely on domain reputation or blocklists often miss these links, creating longer exposure windows for malware delivery or credential theft.