bafkreigdm2txbgx2janmzdmdnezvdfa7i5kiajzltxpx7tj5nvjxikqvhq[.]ipfs[.]dweb[.]link

This domain, hosted on IPFS via dweb.link, is a crypto drainer designed to steal cryptocurrency wallet credentials and drain victims' funds. The threat type is generic phishing, but the specific payload is a crypto drainer that mimics legitimate wallet interfaces or airdrop sites to trick users into connecting their wallets and approving malicious transactions. Once connected, the drainer automatically transfers assets from the victim's wallet to attacker-controlled addresses.

Evidence from security scans: VirusTotal flagged this domain as malicious by 18 out of 95 security vendors. The domain is registered through CSC Corporate Domains, Inc., and is currently offline. While the exact creation date is not provided, the domain's blocklist count is high due to its association with active crypto phishing campaigns. The elevated risk level is confirmed by the number of vendor flags and the domain's known use in credential theft.

Users who visited this domain should immediately revoke any token approvals granted to the site, transfer remaining funds to a new wallet, and run a security scan on their device. Change passwords for any accounts where credentials may have been entered. Monitor wallet activity and report any unauthorized transactions to local authorities and the relevant blockchain security teams.