bafybeicdq67jrqh6e2u2ktpwhyrbwlyj42gwabeazmsfwszdmmqs3fflki[.]ipfs[.]infura-ipfs[.]io

The domain bafybeicdq67jrqh6e2u2ktpwhyrbwlyj42gwabeazmsfwszdmmqs3fflki.ipfs.infura-ipfs.io was identified as a generic phishing site targeting cryptocurrency wallet users. Analysis indicates the infrastructure was designed to impersonate legitimate wallet interfaces, likely functioning as a crypto drainer to siphon digital assets. The domain is currently offline, though prior activity suggests it was operational for a limited period. Infrastructure analysis reveals the domain was flagged by 18 of 95 security vendors on VirusTotal, indicating moderate to elevated detection rates. It was registered through Gandi SAS and resolved to the IP address 18.233.175.50, hosted on infrastructure belonging to Amazon.com, Inc. (AS14618). The domain was created on February 21, 2026, and appeared on two security blocklists prior to takedown. The SSL certificate was issued by Amazon RSA 2048 M02, a common certificate authority for both legitimate and malicious domains. Notably, the domain was blocked by PhishDestroy and PhishingDB, reinforcing its classification as phishing infrastructure. Current status confirms the domain has been taken offline, though residual risk remains for users who may have interacted with it during its active phase. Organizations and individuals are advised to review transaction logs for unauthorized crypto transfers, particularly those initiated around the domain’s active window. Network administrators should ensure endpoint protection systems are updated to detect similar IPFS-based phishing domains, as this vector continues to grow in prevalence. Users who accessed the domain should revoke any connected wallet permissions and monitor for anomalous activity. Given the domain’s creation date in 2026, this may represent a forward-dated registration or a data entry anomaly, warranting further investigation into registrar practices.