bafkreihbey5pmomcuv4rlptqhi6ikjgkrksr62fxsmt2svmfvhqi4sygvy[.]ipfs[.]dweb[.]link

PhishDestroy identifies bafkreihbey5pmomcuv4rlptqhi6ikjgkrksr62fxsmt2svmfvhqi4sygvy.ipfs.dweb.link as an active generic phishing domain with a high risk level. This domain has been flagged for generic phishing activities and is associated with potential credential harvesting or fraudulent transactions. No specific brand or drainer kit has been directly linked to this domain in open-source intelligence, though its configuration suggests it may be used in broader phishing campaigns targeting unsuspecting users under the guise of legitimate services.

This domain exhibits multiple indicators of compromise, including a VirusTotal detection score of 20/95 security vendors, indicating significant but not universal recognition of its malicious nature. It was registered on February 24, 2017, through CSC Corporate Domains, Inc., and resolves to the IP address 209.94.90.2. The domain is currently flagged in Google Safe Browsing (GSB) and is blocked by two major security platforms, OpenPhish and OISD, as well as hosting on the IPFS decentralized web platform. These factors underscore its long-standing presence and ongoing malicious operations in the threat landscape.

Despite active blocking by multiple security vendors and blocklists, bafkreihbey5pmomcuv4rlptqhi6ikjgkrksr62fxsmt2svmfvhqi4sygvy.ipfs.dweb.link remains operational and poses a high-risk threat. Users are advised to avoid interacting with this domain or any associated URLs. Organizations should ensure their security solutions are updated to block access to this domain and its IP address. The persistent activity of this domain, despite its age, highlights the ongoing challenge of combating long-lived phishing infrastructure and the necessity for continuous vigilance and proactive threat intelligence sharing.