bafybeibdyr3vrviyiqdrraxyk5dxy5fb6subupjbgqwyvki3b7pn2h32lm[.]ipfs[.]w3s[.]link

This domain, bafybeibdyr3vrviyiq.ipfs.w3s.link, is identified as a brand impersonation threat targeting Base, a Layer 2 blockchain network. Analysis of the infrastructure reveals the domain was designed to mimic legitimate Base-related services, likely to deceive users into engaging with fraudulent crypto transactions or credential submission. The page title, 'The Courier Guy,' does not align with Base’s branding, suggesting an attempt to obfuscate the true intent of the page or a misconfiguration in the phishing kit deployment. No direct evidence of a crypto drainer script was observed, but the domain’s structure and hosting method (IPFS via Cloudflare) are consistent with tactics used in cryptocurrency-related fraud campaigns. Technical indicators confirm the elevated risk associated with this domain. It is flagged by 21 out of 95 security vendors on VirusTotal, indicating broad detection across multiple threat intelligence platforms. The domain was registered through 1API GmbH on June 27, 2022, and resolves to the IPv6 address 2a06:98c1:3108::ac40:9257, hosted on Cloudflare’s infrastructure (AS13335). The SSL certificate is issued by Google Trust Services (WE1), a common feature in both legitimate and malicious domains to avoid immediate browser warnings. The domain appears on two security blocklists and is explicitly blocked by PhishDestroy and PhishingDB. Despite its creation date suggesting longevity, the domain’s association with brand impersonation and its detection history raise significant concerns. As of the latest assessment, the domain has been taken offline, likely due to enforcement actions by the hosting provider or domain registrar. However, the residual risk remains elevated due to the domain’s prior use in brand impersonation and its potential for re-emergence under similar infrastructure. Organizations and users are advised to monitor for related indicators of compromise, including the IPv6 address, registrar details, and SSL certificate issuer. Blocking the domain and its associated IP at the network level is recommended to prevent accidental access. Users should verify the authenticity of any Base-related communications or services by cross-referencing official channels and avoiding interaction with unsolicited links or pages.