bafkreiamv3yhlxvul2zbvepibgguc5ohocfr7alep7bv4s5z66vucd5vgm[.]ipfs[.]dweb[.]link

PhishDestroy identifies bafkreiamv3yhlxvul2zbvepibgguc5ohocfr7alep7bv4s5z66vucd5vgm.ipfs.dweb.link as a high-risk crypto drainer phishing site that silently swaps wallet addresses during transactions. The page impersonates legitimate IPFS-hosted content while surreptitiously loading a drainer kit designed to steal crypto-asset transfers. No specific brand appears to be impersonated in the payload, indicating a generic but highly effective wallet-draining campaign targeting unsuspecting users who access files via this link. This domain was flagged by 18 out of 95 VirusTotal scanners, uses a Let’s Encrypt SSL certificate, and resolves to IP address 209.94.90.3. Registered through CSC Corporate Domains, Inc. on February 24, 2017, it has been blocked by OpenPhish, CERT-PL, and OISD and appears on three major security blocklists. Its extended age and clean historical registration data make it a stealthy phishing vector that evades simple reputation checks. The website remains actively accessible and continues to serve the malicious payload, indicating ongoing malicious operations. Immediate user action includes verifying any IPFS link against PhishDestroy before interaction. While hosting providers and blocklists have flagged the domain, the underlying drainer kit may still reach users via alternative mirrors or shortened URLs, leaving a residual risk of successful wallet compromise.