bafkreiflcz4b7rnhk5r3w52drlysvolzauhvz4kltcq6qpzfzdajyudqm4[.]ipfs[.]dweb[.]link

This domain is flagged as an elevated-risk phishing threat targeting cryptocurrency users. Analysis indicates the site functions as a crypto drainer, a type of malicious page designed to siphon funds from digital wallets by tricking users into connecting their wallets or entering private keys. The threat leverages IPFS (InterPlanetary File System) decentralized hosting, making it harder to takedown, and employs Cloudflare infrastructure to obscure its origin. The page title '400 Bad Request' suggests either a misconfigured phishing kit or an attempt to evade detection by appearing as a broken or inactive site. Infrastructure analysis reveals the domain was created on February 24, 2017, and registered through CSC Corporate Domains, Inc., a registrar commonly used for both legitimate and malicious domains. It resolves to the IP address 209.94.90.3 and uses a Let's Encrypt SSL certificate to appear secure. The domain is detected by 12 out of 95 security vendors on VirusTotal, confirming its malicious nature. It also appears on one security blocklist and was actively blocked by at least one anti-phishing service prior to being taken offline. If you visited this domain or interacted with its content, immediate action is required. Disconnect any cryptocurrency wallets that may have been linked to the site and revoke any suspicious token approvals using a blockchain explorer or wallet management tool. Scan your device for malware using updated security software to ensure no additional payloads were delivered. Monitor your wallet transactions for unauthorized activity and consider transferring funds to a new wallet if you entered sensitive information. Report the domain to your wallet provider and relevant security teams to aid in further takedown efforts. Avoid clicking on similar links, especially those hosted on decentralized networks like IPFS, unless verified through trusted sources.