bafkreihadkrznu7jvvqxq7o54zadk54gtb22sy6mxcueelllxyd7uv3miq[.]ipfs[.]dweb[.]link

PhishDestroy identifies bafkreihadkrznu7jvvqxq7o54zadk54gtb22sy6mxcueelllxyd7uv3miq.ipfs.dweb.link as a generic phishing domain hosting crypto-draining JavaScript, designed to empty victim wallets or harvest credentials within seconds of wallet connection. The link mimics legitimate IPFS gateways and may appear in social-media DMs, fake airdrop sites, or NFT giveaway tweets, urging users to connect their wallets to “claim rewards.” No specific brand impersonation is named in public blocklists, so the campaign likely casts a wide net to siphon assets from any supported chain. This domain resolves to AS209.94.90.3 via a 2017-registered host under CSC Corporate Domains, Inc. A Let’s Encrypt SSL certificate secures TLS, tricking visitors into believing the connection is safe. VirusTotal currently returns 18 out of 95 detections (0 %), indicating the payload is either brand-new or employs sophisticated obfuscation. The infrastructure is already flagged by the OpenPhish blocklist (count = 1), suggesting it sits at the launch stage of a longer campaign rather than an established sinkhole. As of this assessment the domain remains active and the drainer kit continues to receive updates, elevating the immediate risk to any wallet holder who connects. PhishDestroy recommends blocking 209.94.90.3 at the firewall and disabling IPFS gateway redirects in browser settings. Users should treat any link containing “ipfs.dweb.link” with extreme caution until the payload signature reaches detections on major scanners; consider revoking wallet connections via block-explorer tools and enabling multi-sig or hardware-wallet restrictions to limit potential losses.