bafybeif2v4tzjfkmfxuxylhezpqrwrptfkfu3tshsyvk2te4rle62kjjwu[.]ipfs[.]infura-ipfs[.]io

The domain bafybeif2v4tzjfkmfxuxylhezpqrwrptfkfu3tshsyvk2te4rle62kjjwu.ipfs.infura-ipfs.io is currently classified as a high‑risk generic_phishing infrastructure and remains active as of the report date. It was registered through GANDI SAS on 30 January 2020 and resolves to the IP address 209.94.90.3, which belongs to AS40680 (Protocol Labs) in the United States. DNS resolution is serviced by four Amazon Route 53 nameservers (ns-1433.awsdns-51.org, ns-1615.awsdns-09.co.uk, ns-221.awsdns-27.com, ns-516.awsdns). The site returns an HTTP 301 redirect and presents a TLS certificate issued by Amazon (RSA 2048 M02). Automated analysis has identified the use of IPFS, Python, Django, Cloudflare, and HTTP/3. Reputation data shows a Gridinsoft trust score of 0 / 100, and fifteen of ninety‑five VirusTotal scanners flagged the domain. It is listed on two public blocklists, specifically PhishDestroy and PhishingDB, and the page title reported is "Webmail". While the exact phishing payload or targeted brand is not disclosed, the combination of a generic webmail title and the observed infrastructure suggests a credential‑harvesting campaign. Defenders should block DNS resolution to the listed IP, add the domain to URL filtering policies, monitor for outbound connections to the AS40680 prefix, and ensure that any authentication attempts to services associated with the "Webmail" title are logged and investigated. Continuous monitoring of the associated blocklists is advised to capture any future changes in the domain’s status.