bafkreiet3tiwgyyprzk75i6dijdwunp3wxoggjy5q273zrhzy56iuuizi4[.]ipfs[.]dweb[.]link

PhishDestroy identifies bafkreiet3tiwgyyprzk75i6dijdwunp3wxoggjy5q273zrhzy56iuuizi4 as an active crypto-drainer domain currently under investigation for funds theft. This IPFS gateway endpoint mimics legitimate crypto-service interfaces to trick users into signing malicious transactions that silently drain wallet balances. The domain resolves to 209.94.90.3 via CSC Corporate Domains, Inc., a registrar historically associated with bulletproof hosting for high-risk campaigns. Registered on February 24, 2017, the domain operates under a free Let’s Encrypt certificate to appear benign while evading early browser warnings. Technical indicators show zero detections on VirusTotal (20/95 engines) as of the latest scan, indicating novel or highly targeted infrastructure that has yet to be widely blacklisted. The combination of an aged domain, reputable registrar, and absence of AV coverage suggests this gateway is actively refining its payload delivery before broader deployment. Security researchers note that the IPFS path (bafkreiet...) is a CIDv1 multibase encoding commonly abused to host phishing pages on decentralized storage, bypassing traditional takedown routes. If you accessed this domain or entered any wallet credentials, immediately revoke connected permissions using your wallet’s provider dashboard. Transfer remaining funds to a new, air-gapped wallet with a unique seed phrase. Run a malware scan on all devices used for crypto transactions and enable hardware wallet signing for future transactions. Report the incident to your wallet provider and local cybercrime units with the unique seed 4b8b04 for cross-referencing.