bafybeiguc2wldadcecll4xc5ikl6xkbl2vb5tu4pq2vmr6prjcls4oogiy[.]ipfs[.]dweb[.]link

This domain, bafybeiguc2wldadcecll4xc5ikl6xkbl2vb5tu4pq2vmr6prjcls4oogiy.ipfs.dweb.link, operates as a crypto wallet drainer phishing infrastructure leveraging the InterPlanetary File System (IPFS) decentralized web protocol. Analysis indicates the site presents fraudulent cryptocurrency wallet interfaces designed to trick users into entering private keys or seed phrases, enabling attackers to drain funds from connected wallets. The use of IPFS (dweb.link gateway) allows the phishing content to persist even if the original hosting node is taken offline, complicating takedown efforts. Infrastructure analysis reveals multiple high-confidence indicators of malicious activity. The domain resolves to IPv6 address 2602:fea2:2::3, hosted on AS40680 (Protocol Labs) in the United States, and uses a Let's Encrypt SSL certificate (serial number E7). VirusTotal detection rates show 19 out of 95 security vendors flagging the domain as malicious, while two independent security blocklists (PhishDestroy and PhishingDB) have listed it. The domain was registered through CSC Corporate Domains, Inc., with a creation date of February 24, 2017, though the phishing content appears to have been deployed more recently. Users who visited this domain or interacted with its content should immediately disconnect any connected cryptocurrency wallets from the internet and transfer remaining assets to a new wallet with a fresh seed phrase. Any entered credentials, private keys, or seed phrases must be considered compromised. Monitor connected accounts for unauthorized transactions and report the incident to relevant blockchain security teams. The domain's current offline status does not guarantee safety, as IPFS-based phishing content may reappear through alternative gateways or peer nodes.