bafkreidd3us27ur67oh55sl2mjcbsf56riyaackwwalbklx2dk6vmixa3u[.]ipfs[.]dweb[.]link

PhishDestroy identifies the IPFS-hosted domain bafkreidd3us27ur67oh55sl2mjcbsf56riyaackwwalbklx2dk6vmixa3u.ipfs.dweb.link as an active generic phishing endpoint seeding a cryptocurrency drainer kit. This loader does not impersonate a specific brand; instead it delivers an off-the-shelf drainer designed to empty victim wallets within seconds of signature approval. The payload is delivered via the InterPlanetary File System (IPFS) gateway at dweb.link, allowing the threat actor to bypass traditional web-hosting takedowns by rotating only the content hash rather than the full URL. Domain creation date is 2017-02-24, registered through CSC Corporate Domains, Inc. VirusTotal currently shows 20/95 detections, indicating no AV signatures yet. The endpoint resolves to IPv4 209.94.90.3 and is secured with a Let’s Encrypt certificate. Google Safe Browsing (GSB) has not yet flagged this URL, and third-party blocklists show zero listings at the time of analysis. These attributes suggest a newly deployed, lightly fingerprinted campaign that is actively evading detection layers. This domain remains under investigation with an active status and medium risk classification. Response actions include continuous VT re-scanning every four hours, automated GSB submission, and real-time IP/domain sinkholing. Remaining risk is moderate due to the drainer’s rapid wallet-draining capability and the actor’s use of IPFS to prolong infrastructure uptime. Users are advised to verify any crypto-related link using PhishDestroy before signing transactions.