bafkreiclx2rtmk2k77tsbghnjtvuk3tio7rsh6douxrekuvo4hkmogx7uy[.]ipfs[.]dweb[.]link

This domain is flagged as a generic phishing threat targeting cryptocurrency users through an IPFS gateway impersonation. The site presents itself as a legitimate IPFS Service Worker Gateway with the page title 'IPFS Service Worker Gateway | HEAD@572bc4a', attempting to deceive visitors into entering sensitive credentials or wallet information. Analysis indicates the domain is designed to function as a crypto drainer, silently redirecting or intercepting transactions to steal digital assets without user consent. Infrastructure analysis reveals multiple technical indicators confirming malicious intent. The domain resolves to IP address 209.94.90.2 and was registered through CSC Corporate Domains, Inc. on February 24, 2017. It holds a Let's Encrypt SSL certificate (identifier E8) and appears on one security blocklist. VirusTotal detection shows 18 out of 95 security vendors flagging the domain as malicious, with specific categorization as a phishing threat by multiple engines. The domain's current status is offline, though historical activity remains a concern for users who may have interacted with it previously. Users who visited this domain should immediately revoke any permissions granted to the site and disconnect connected wallets. Check browser extensions for unauthorized additions and run a full antivirus scan to detect potential malware. Review transaction history for unauthorized crypto transfers and report any suspicious activity to relevant blockchain explorers. If credentials were entered, change passwords on all associated accounts and enable multi-factor authentication where available. Monitor financial statements for signs of unauthorized access, as phishing domains often harvest data for later exploitation even if immediate theft is not detected.