bafybeigys74llssoyzme5yywtjsjhlqew3sksohbzsne6ouewercf7vu6a[.]ipfs[.]dweb[.]link

PhishDestroy identifies an active crypto-draining phishing campaign linked to the domain bafybeigys74llssoyzme5yywtjsjhlqew3sksohbzsne6ouewercf7vu6a.ipfs.dweb.link. This host poses an elevated risk, with threat actors using it to host malicious JavaScript that silently drains cryptocurrency wallets upon user interaction. The infrastructure mimics legitimate IPFS gateway paths, deceiving users into connecting their wallets to drainer scripts that authorize unauthorized transfers under the guise of authentication or transaction signing. This domain was flagged by multiple threat intelligence sources, including OpenPhish and OISD, with detections confirmed by 20 out of 95 VirusTotal security vendors. Registered through CSC Corporate Domains, Inc., the domain has been active since February 24, 2017, and appears on two dedicated blocklists. It resolves to IP address 209.94.90.2 and uses a Let’s Encrypt SSL certificate, adding superficial legitimacy. The combination of longevity, public blocklist presence, and high AV detection rate highlights the persistent threat this domain poses to cryptocurrency users. Users who have accessed this domain should immediately disconnect any connected wallets, revoke unauthorized permissions via blockchain explorers or wallet interfaces, and scan devices for malware. Avoid re-engaging with this domain or its path structure. Report any suspicious transactions to relevant blockchain security platforms and update wallet software with the latest phishing filters. Always verify URLs via trusted sources like PhishDestroy before entering wallet credentials or authorizing transactions.