bafybeidxahrxhks6sxg55utlzyrp63a57hd3cicdxf7pbsehffe4n7th3u[.]ipfs[.]dweb[.]link

PhishDestroy identifies the malicious domain bafybeidxahrxhks6sxg55utlzyrp63a57hd3cicdxf7pbsehffe4n7th3u.ipfs.dweb.link as an active crypto drainer phishing site impersonating a well-known platform. The threat remains in active circulation, leveraging deceptive techniques to trick users into connecting crypto wallets or entering credentials that are subsequently drained by the attacker. This infrastructure is part of an ongoing campaign targeting cryptocurrency users through false promises of rewards, airdrops, or giveaways.

This domain was flagged by 18 of 95 VirusTotal security vendors, indicating elevated risk. It was registered through CSC Corporate Domains, Inc., resolving to a static IP address at 209.94.90.3. The domain was created on February 24, 2017, suggesting a long-standing but recently compromised or repurposed presence. The SSL certificate, issued by Let’s Encrypt, adds a false sense of legitimacy to the malicious site.

Security teams are advised to block this domain at the network perimeter and DNS level immediately. Users should avoid interacting with any unsolicited links or QR codes leading to this domain. Verify suspicious URLs using PhishDestroy before clicking. Continuously monitor network logs for outbound connections to IP 209.94.90.3 or queries to this domain. If this site appears in phishing emails or social engineering attempts, report it to relevant threat intelligence platforms and coordinate with cybersecurity teams to prevent credential or cryptocurrency loss.