bafkreidsfteign6t345vr7fozvxb3jcg7h4rojn2c6kmvjrxpmgdsslx4e[.]ipfs[.]dweb[.]link

The domain bafkreidsfteign6t345vr7fozvxb3jcg7h4rojn2c6kmvjrxpmgdsslx4e.ipfs.dweb.link has been identified as a crypto drainer phishing threat. Analysis indicates the domain is currently offline, returning a 410 Gone HTTP status code. No specific brand impersonation was detected, but the infrastructure is designed to facilitate unauthorized cryptocurrency transactions by tricking users into connecting wallets or entering private keys. Infrastructure analysis reveals the domain resolves to the IP address 209.94.90.2, hosted under AS40680 (Protocol Labs) in the United States. The domain was registered on March 01, 2026, through CSC Corporate Domains, Inc., and is associated with a Let's Encrypt SSL certificate (serial number E7). Security vendors have flagged this domain as malicious, with 21 out of 95 VirusTotal engines detecting it as a threat. Additionally, the domain appears on one security blocklist, further corroborating its malicious nature. The page title, 410 Gone, suggests the domain may have been actively mitigated or abandoned following detection. Current status indicates the domain is offline, reducing immediate risk to users. However, the infrastructure remains a potential threat vector. Organizations and individuals are advised to block the domain and its associated IP (209.94.90.2) at the network level. Users should verify wallet connections and avoid interacting with unsolicited links, particularly those distributed via email or social media. Monitoring for similar domains registered through the same registrar or resolving to the same IP range is recommended to preemptively mitigate related threats. Cryptocurrency users should enable transaction simulation tools and multi-factor authentication for wallet access to minimize exposure to drainer attacks.