# PhishDestroy threat dossier — bafybeicrx6mxjdmgvh7372dgpwudwaunxrrcmmzyotodztwlzppzgiu5xm.ipfs.dweb.link ================================================================ Fetched: 2026-04-29 00:53:08 UTC Canonical: https://phishdestroy.io/domain/bafybeicrx6mxjdmgvh7372dgpwudwaunxrrcmmzyotodztwlzppzgiu5xm.ipfs.dweb.link/ ## VERDICT ---------------------------------------------------------------- STATUS STALE — last probed 15 days ago, treat as ACTIVE until re-verified Composite threat score: 93/100 (PhishDestroy scoring — see methodology below) Scam classification: Crypto Scam Targeted brand: Base ## DETECTION EVIDENCE ---------------------------------------------------------------- VirusTotal: 10/95 security vendors flagged this domain Flagging vendors: ADMINUSLabs, alphaMountain.ai, BitDefender, CRDF, CyRadar, G-Data, Kaspersky, Lionic, Sophos, Webroot Public blocklists: listed on 4 independent blocklists Victim re-reports (public form): 1 ## INFRASTRUCTURE ---------------------------------------------------------------- IP address: 209.94.90.3 (US, San Francisco) ASN: ASAS40680 PROTOCOL, US Hosting org: AS40680 Protocol Labs Registrar: CSC Corporate Domains, Inc. Nameservers: clarissa.ns.cloudflare.com, tate.ns.cloudflare.com Registered: 2017-02-24 Expires: 2026-02-24 Page title: Andy on Base HTTP response: 410 ## TLS CERTIFICATE ---------------------------------------------------------------- Issuer: Let's Encrypt / E7 Expires: 2026-04-25 Status: INVALID chain Fingerprint: b0f8011326dd0e8a1ae8481540208adfc888bb71273b3bd3bc56e92749f9f5db Subject Alternative Names (related infrastructure — often same operator): - dweb.link ## ABUSE-REPORT HISTORY (evidence of registrar non-response) ---------------------------------------------------------------- Status: pending notification queue. No abuse reports filed yet — this domain is waiting for the next cycle of our automated abuse-reporter. ## TIMELINE ---------------------------------------------------------------- Domain registered: 2017-02-24 (per WHOIS / CT — may reflect a renewal or transfer date, not first-ever registration) First detected: 2026-02-25 02:39:27 UTC (by PhishDestroy tracker) First reported: 2025-08-09 14:08:59 UTC (abuse notice filed) Last verified: 2026-04-13 09:45:44 UTC (STALE — 15 days ago, re-verify) Flagged dead: 2026-02-27 01:44:50 UTC (NOT RE-VERIFIED IN 15 DAYS — treat as unconfirmed) Current status: UNCONFIRMED (our live-probe is 15 days stale) ## EXTERNAL CORROBORATION (third-party evidence) ---------------------------------------------------------------- URLScan.io: https://urlscan.io/result/01988fce-8086-745c-a12c-a51d8500b844/ Wayback Machine: https://web.archive.org/web/*/bafybeicrx6mxjdmgvh7372dgpwudwaunxrrcmmzyotodztwlzppzgiu5xm.ipfs.dweb.link crt.sh CT logs: https://crt.sh/?q=%25.bafybeicrx6mxjdmgvh7372dgpwudwaunxrrcmmzyotodztwlzppzgiu5xm.ipfs.dweb.link Google transparency: https://transparencyreport.google.com/safe-browsing/search?url=bafybeicrx6mxjdmgvh7372dgpwudwaunxrrcmmzyotodztwlzppzgiu5xm.ipfs.dweb.link AlienVault OTX: https://otx.alienvault.com/indicator/domain/bafybeicrx6mxjdmgvh7372dgpwudwaunxrrcmmzyotodztwlzppzgiu5xm.ipfs.dweb.link URLhaus: https://urlhaus.abuse.ch/host/bafybeicrx6mxjdmgvh7372dgpwudwaunxrrcmmzyotodztwlzppzgiu5xm.ipfs.dweb.link/ ## ANALYST NARRATIVE ---------------------------------------------------------------- [Generated: 2026-03-19 02:03:04 UTC — narrative may predate facts above. Treat fields in TIMELINE / DETECTION EVIDENCE / INFRASTRUCTURE as authoritative if they differ from the prose below.] PhishDestroy identifies the domain bafybeicrx6mxjdmgvh7372dgpwudwaunxrrcmmzyotodztwlzppzgiu5xm.ipfs.dweb.link as a high-risk phishing site. Users exposed to this domain faced significant danger as it was designed to trick visitors into divulging sensitive information by impersonating trusted sources. Although the domain is now taken offline, the risk it posed was considerable due to its questionable reputation and multiple security blocklist appearances. This phishing operation likely aimed to lure users through a page titled "Andy on Base," enticing victims to engage with content that could compromise their credentials or personal data. The domain was registered in 2017 and flagged by 10 out of 95 VirusTotal security vendors, while receiving a low trust score of 30/100 on Scamadviser, indicating a distrustworthy nature. Being hosted on an IP associated with suspicious activity, the domain served as a trap to catch unaware users through deceptive tactics common in phishing schemes. If you have visited this site, it is important to immediately verify any accounts or sensitive credentials you may have entered for suspicious activity. Change passwords and enable multi-factor authentication where possible. Users are also advised to avoid clicking on unknown links and to utilize security tools to scan their devices for potential threats. Staying vigilant and informed prevents falling victim to phishing attacks like those linked to the bafybeicrx6mxjdmgvh7372 domain. [Updates since narrative was generated:] - VirusTotal detections: now 10/95 (narrative was written when count was lower) ## EVIDENCE HASHES ---------------------------------------------------------------- TLS cert SHA-256: b0f8011326dd0e8a1ae8481540208adfc888bb71273b3bd3bc56e92749f9f5db ## SCORING METHODOLOGY ---------------------------------------------------------------- Composite score is NOT derived from VirusTotal alone. PhishDestroy aggregates: - VirusTotal positive ratio - Public blocklist consensus (MetaMask, ScamSniffer, OpenPhish, PhishTank, URLhaus, CryptoFirewall, SEAL, Polkadot, Enkrypt, Phishunt, DiscordPhishing, PhishingDB) - Cloaking detection (HTTP 666 or rendering delta between bot and real visitor) - DNS-filter consensus (Quad9, CleanBrowsing, NextDNS, AdGuard, Cloudflare, etc.) - AlienVault OTX pulses + Cloudflare Radar + Google Safe Browsing - URLScan / URLQuery verdicts - Brand-impersonation heuristics (DOM analysis of forms, logos, wording) - Known phishing-kit fingerprinting (favicon hash, JS obfuscation signatures) - Wallet-drainer family classification (Angel, MS, Rainbow, Pink, Inferno, ...) - Free-TLS vs paid-cert ratio (throwaway infrastructure signal) - Registrar/hosting abuse history (this registrar's track record) - Human researcher sign-off (volunteer takedown team) A domain present in our database is ALREADY flagged. A low VT count by itself does NOT mean the domain is safe — new scam domains routinely show 0/95 VT for their first 7–30 days while actively draining wallets. Always cross-reference the composite score and the individual indicators above, not just VT. ## CORRECTIONS / APPEALS ---------------------------------------------------------------- Full HTML report: https://phishdestroy.io/domain/bafybeicrx6mxjdmgvh7372dgpwudwaunxrrcmmzyotodztwlzppzgiu5xm.ipfs.dweb.link/ JSON API: https://api.destroy.tools/v1/check?domain=bafybeicrx6mxjdmgvh7372dgpwudwaunxrrcmmzyotodztwlzppzgiu5xm.ipfs.dweb.link Appeal a flag: https://phishdestroy.io/appeals/ (responded to within 48 hours, FP rate <0.01%) Submit a report: https://t.me/PhishDestroy_bot About PhishDestroy: volunteer-driven open-source threat-intelligence platform. Tracked: 131,000+ phishing domains. Confirmed takedowns: 91,000+. Site: https://phishdestroy.io