bafkreidgiyammo6oxvvlojem4p2rt24uepltfr7bwg2rdcqn24pir4rvne[.]ipfs[.]dweb[.]link

The domain bafkreidgiyammo6oxvvlojem4p2rt24uepltfr7bwg2rdcqn24pir4rvne.ipfs.dweb.link has been identified as a generic phishing threat by PhishDestroy, carrying an elevated risk level. While no specific brand impersonation or drainer kit has been associated with this domain, its infrastructure and behavior strongly suggest malicious intent, likely aiming to deceive users into divulging sensitive information. The site is hosted on IPFS via dweb.link, a decentralized web gateway, which can complicate takedown efforts.

Technical indicators paint a clear picture of risk. VirusTotal reports 20 out of 95 security vendors flagging this domain as malicious, a significant consensus. The domain was registered on February 24, 2017, through CSC Corporate Domains, Inc., and resolves to IP address 209.94.90.2. It is listed on one security blocklist, and its SSL certificate is issued by Let's Encrypt (E8). The page title displayed a "400 Bad Request" error, suggesting the site may have been misconfigured or actively taken offline. Google Safe Browsing status was not provided, but the blocklist presence indicates prior malicious activity.

Currently, the domain is offline, which suggests that either the hosting provider or authorities have intervened. However, users should remain cautious, as similar domains may reappear or the threat actor may pivot to new infrastructure. PhishDestroy recommends avoiding any interaction with this domain and verifying any suspicious links through their platform. If users have previously visited or entered credentials on this site, they should change passwords immediately and enable multi-factor authentication on affected accounts. The decentralized nature of IPFS means that content can persist even after takedown, so continued vigilance is advised.