bafkreiehjatmkhv5y2zkeaj2idmdb5w5mhl6mljeo34tmuhgam2vjzh6ya[.]ipfs[.]nftstorage[.]link

The domain bafkreiehjatmkhv5y.ipfs.nftstorage.link has been identified as a crypto drainer, a threat type designed to siphon cryptocurrency assets from victims by impersonating legitimate services. Analysis of the page title, Webmail :: Welcome to Webmail, indicates an attempt to mimic webmail login portals, likely targeting users of email services associated with cryptocurrency platforms or general enterprise environments. As of the latest assessment, this domain is offline, though prior activity suggests it was actively used in malicious campaigns. Infrastructure analysis reveals this domain was flagged by 20 of 95 security vendors on VirusTotal, indicating a moderate to high confidence level in its malicious nature. It was registered through 1API GmbH and resolves to the IP address 209.94.90.3, hosted on AS40680 (Protocol Labs) in the United States. The domain was created on February 11, 2022, and has since been listed on two security blocklists, including PhishDestroy and PhishingDB. The SSL certificate is issued by Google Trust Services (WE1), which, while not inherently malicious, is commonly exploited in phishing and crypto-related threats to lend an appearance of legitimacy. Current status confirms the domain is offline, reducing immediate risk to users. However, the infrastructure and tactics observed suggest a persistent threat actor. Organizations and individuals are advised to block the domain and its associated IP (209.94.90.3) at the network level. Security teams should monitor for similar domains leveraging IPFS or decentralized storage services to host crypto drainers, particularly those impersonating login portals. End-users should verify the authenticity of webmail or cryptocurrency-related login pages by inspecting URLs, SSL certificates, and domain registration details before entering credentials or connecting wallets.