bafkreidgrzz5a5olpbqqm66sjo442pfrbkrq4obr54gf2zhh4rxh3bdq5u[.]ipfs[.]dweb[.]link

PhishDestroy identifies bafkreidgrzz5a5olpbqqm66sjo442pfrbkrq4obr54gf2zhh4rxh3bdq5u.ipfs.dweb.link as an active crypto drainer infrastructure operating under the guise of IPFS-hosted content. The domain leverages social engineering tactics to trick users into connecting crypto wallets under the false pretense of accessing legitimate decentralized content. No specific brand is directly impersonated in this campaign; however, the use of IPFS hosting (a legitimate decentralized storage protocol) serves as a decoy to distribute malicious drainer scripts. The drainer kit is designed to execute unauthorized token transfers upon wallet connection, targeting users seeking to access files or media hosted on IPFS networks. This domain was flagged with a high-risk profile across multiple security platforms. VirusTotal analysis confirms detection by 14 out of 95 security vendors, indicating partial but not universal recognition of the threat. The domain is registered through CSC Corporate Domains, Inc., and resolves to IP address 209.94.90.3. Domain creation occurred on February 24, 2017, which may indicate reuse of an older, compromised domain for current malicious purposes. Google Safe Browsing classifies this domain under SOCIAL_ENGINEERING, and it is blocked by both OISD and one additional security blocklist, reflecting consistent malicious reputation. The combination of age, blocklist status, and partial detection coverage highlights a sophisticated and evasive threat actor. As of current monitoring, this domain remains actively engaged in malicious operations with high risk to end users. Immediate takedown or remediation efforts have not been confirmed at this time, leaving the infrastructure operational. Users are strongly advised to avoid any interaction with this domain, especially those involving wallet connections or file downloads. Existing detection signatures (14/95) suggest incomplete protection, warranting user vigilance and reliance on real-time threat intelligence. The combination of social engineering tactics, partial detection coverage, and active status elevates the risk profile, reinforcing the need for proactive security measures and user education.