bafkreie6l2lznn4hojw4lyfbohdedsoqrltmieqtrkzumwrk6bdss564bu[.]ipfs[.]dweb[.]link

PhishDestroy has detected an active generic-phishing threat hosted at bafkreie6l2lznn4hojw4lyfbohdedsoqrltmieqtrkzumwrk6bdss564bu.ipfs.dweb.link. This site is designed to trick visitors into surrendering sensitive information such as login credentials, payment details, or personal data by masquerading as a legitimate service. Attackers often leverage IPFS gateway links like this one to bypass traditional web-filtering controls, making the page appear more credible while delivering malicious payloads or harvesting keystrokes in the background. This domain was formally flagged by PhishDestroy on 24 February 2017 and is currently resolving to IP address 209.94.90.2. According to VirusTotal telemetry dated 24 February 2017, nine of ninety-five participating security vendors already identify it as malicious. The domain is registered through CSC Corporate Domains, Inc., and protected with a Let’s Encrypt SSL certificate, which can give visitors a false sense of security because the padlock icon does not guarantee safety—only encryption. If you visited this page or entered any information, disconnect from the internet immediately and run a full antivirus scan on all devices that touched the link. Change any passwords you may have typed while on the site, enable multi-factor authentication wherever possible, and monitor financial accounts for unusual transactions. Report the domain to your organization’s security team or to PhishDestroy for takedown assistance. Avoid reopening the link; instead, rely on official communication channels to verify any requests for personal data. Staying vigilant about unusual URLs and validating sources before entering credentials remains the best defense against these evolving tactics.