Exploring Data Collection, Analysis & Security

IPFS is a peer-to-peer network that addresses files by content identifiers (CIDs) rather than by server location. Peers hold records that point to which node owns each CID, while the content stays on the owner's node. The network is about ten years old, and both blockchain projects and abusive actors use it, including phishing pages, darknet marketplaces and the IPStorm botnet, which used it for command and control.

The middle of the talk explains how investigators can pivot on IPFS data. Links surface in blockchain transactions, email, forums and chat, and existing scanning results may already cover them. A gateway error can mean censorship or an unreachable host, so trying other gateways or archives helps. Because a CID embeds a SHA-256 digest, a file hash can be derived from a link and checked against indicator feeds. Node identities can be profiled through peer IDs, addresses, agent versions and pubsub topics. IPFS keeps no history, so continuous monitoring with many nodes spread across the identifier space is needed.

The closing advice is that blocklists built on specific gateway URLs are easy to bypass, since switching gateways is trivial, so matching on CIDs or hashes is more durable. Attackers may run their own nodes to keep content available, and malware may try IPFS first and fall back to other channels. Requests to centralized gateway or pinning providers may also reveal who uploaded content.