bafkreicbpqywq5ch35rrdphymwre2gr7b2xovnmjzfavlpu6da7piciuce[.]ipfs[.]dweb[.]link

PhishDestroy identifies bafkreicbpqywq5ch35rrdphymwre2gr7b2xovnmjzfavlpu6da7piciuce.ipfs.dweb.link as an active generic phishing host operating as a crypto-asset drainer. The domain routes users to a malicious web wallet that silently siphons deposited tokens into attacker-controlled addresses. No specific brand is impersonated in the observed payload, indicating a broad opportunistic campaign aimed at cryptocurrency holders visiting IPFS gateways.

This domain was flagged with a VirusTotal score of 16/95 security vendors on first submission, strongly correlating with malicious intent. Registration occurred through CSC Corporate Domains, Inc. on February 24, 2017, suggesting a long-dormant domain recently repurposed for illicit hosting. Resolution points to IPv4 address 209.94.90.2, which is not associated with any legitimate IPFS infrastructure. A Let’s Encrypt SSL certificate provides a veneer of legitimacy, while the domain is currently blocked by two high-confidence threat-intel feeds: OpenPhish and OISD, placing it on PhishDestroy’s elevated-risk watchlist.

As of today, this crypto drainer remains active and is actively serving malicious payloads to unsuspecting visitors. Immediate mitigation includes DNS blocking of 209.94.90.2 and blacklisting the domain via enterprise gateways and endpoint protection platforms. Despite blocklist coverage, the domain’s long registration history and SSL certificate mean it can evade cursory scans; therefore, users should verify any IPFS link against PhishDestroy’s live database before interaction. Remaining risk is elevated due to the drainer’s autonomous operation and the difficulty of removing content once pinned on IPFS, necessitating continuous monitoring and rapid response to takedown requests.