bafkreihydvdhzs6gfta7ekculce3znjxsfk5qgsqip34s6lokwky4tkycm[.]ipfs[.]dweb[.]link

PhishDestroy has flagged a generic phishing domain hosted on IPFS, identified by seed 4ff45e, as an active threat under investigation. This domain is not associated with a specific brand or drainer kit at this time, indicating a broad, opportunistic campaign. The infrastructure relies on decentralized hosting via IPFS, leveraging a Let's Encrypt SSL certificate for perceived legitimacy. The lack of immediate detection by security vendors underscores the evolving tactics employed by threat actors to evade traditional defenses. This domain, created on February 24, 2017, resolves to the IP address 209.94.90.2 and is registered through CSC Corporate Domains, Inc. According to VirusTotal, it currently shows 0 detections out of 95 scanners, highlighting its stealthy nature. The domain remains unlisted on Google Safe Browsing (GSB) and has not been flagged by other major blocklists, suggesting it is still in the early stages of deployment. The use of Let's Encrypt for SSL certificates is a common tactic to avoid raising red flags in automated security checks. The domain is classified as an active generic phishing threat, with no confirmed association to a specific brand, crypto drainer, or credential theft scheme at this time. PhishDestroy continues to monitor this threat, and users are advised to avoid interaction until further intelligence is gathered. While the risk level remains 'under_investigation,' the lack of detections and blocklist entries means this domain could be weaponized quickly. Organizations and individuals should review their security posture and consider blocking the associated IP (209.94.90.2) and domain as a precautionary measure.