bafkreib5a2pevnxcwy6nv2q4ysjyppjehbxjpoms6fwaoqtdetxrdccswa[.]ipfs[.]dweb[.]link

PhishDestroy identifies a credential-theft phishing page hosted at bafkreib5a2pevnxcwy6nv2q4ysjyppjehbxjpoms6fwaoqtdetxrdccswa.ipfs.dweb.link that steals login details rather than installing malware. If visited, the site poses an elevated risk of exposing passwords, crypto-wallet seeds, or 2FA codes entered on the fake login form. The page tricks users by mimicking a legitimate service, yet sends captured credentials to attacker-controlled servers instead of the real site. This domain was flagged by PhishDestroy based on multiple signals: VirusTotal detection by 8 out of 95 security vendors, creation on February 24 2017, and registration through CSC Corporate Domains using a Let’s Encrypt certificate on IP 209.94.90.3. The long registration history and use of a reputable registrar can obscure the true threat, so additional checks are essential. If you visited the page, immediately change any passwords you may have entered and revoke any API keys or browser sessions tied to the affected account. Scan your device with an up-to-date antivirus and consider rotating crypto-wallet access credentials and mnemonic phrases. Report the domain to your security team or to PhishDestroy to help block future visitors.