bafybeihimrngdajl6w5pztnvosqydwgis2dui2mid2kadxqnnfpwavooiq[.]ipfs[.]dweb[.]link

This domain poses a high risk to users by attempting to steal cryptocurrency through a crypto drainer phishing attack. The site is designed to trick visitors into revealing sensitive information or installing malicious software that can siphon off funds from their digital wallets.

Analysis indicates that 16 out of 95 security vendors on VirusTotal flagged this domain as malicious, highlighting a significant level of concern. The domain was created on March 02, 2026, and is registered through CSC Corporate Domains, Inc. Infrastructure analysis reveals that the domain resolves to an IP address (209.94.90.2) located in the United States, specifically under the Autonomous System (AS40680) of Protocol Labs. The site is currently offline and appears on four security blocklists, including PhishDestroy, MetaMask, ScamSniffer, and SEAL. The SSL certificate is issued by Let's Encrypt, which is a common practice among phishing sites to gain user trust.

If a user has visited this domain, it is crucial to take immediate action to mitigate potential risks. The first step is to change all passwords and enable two-factor authentication on any accounts that may have been compromised. Users should also monitor their cryptocurrency wallets and transactions for any unauthorized activity. In addition, running a comprehensive security scan on the device used to access the site can help identify and remove any malware that may have been installed. Reporting the incident to a cybersecurity professional or the relevant authorities is also recommended to ensure a thorough investigation and to prevent further spread of the threat.