bafybeigbqwmxazxynaputje3qz5bp5im3grqzyqdzb3r3xb5uuzysijlt4[.]ipfs[.]infura-ipfs[.]io

The domain bafybeigbqwmxazxynaputje3qz5bp5im3grqzyqdzb3r3xb5uuzysijlt4.ipfs.infura-ipfs.io has been assessed as presenting an elevated risk of a generic phishing threat. The domain, which was registered through GANDI SAS and created on January 30, 2020, has been taken offline. However, the historical data and current threat indicators suggest that it was actively used for malicious purposes.

Analysis indicates that the domain has been flagged by 21 out of 95 security vendors on VirusTotal, highlighting a significant level of suspicion among the cybersecurity community. The domain resolves to the IP address 209.94.90.3, which is located in the United States and belongs to AS40680 Protocol Labs. The SSL certificate used was issued by Amazon, specifically an Amazon RSA 2048 M02 certificate, which may have been used to gain user trust. The domain appears on two security blocklists, PhishDestroy and PhishingDB, further corroborating its involvement in phishing activities. The page title, 'Webmail,' is a common indicator used in phishing sites to lure users into believing they are accessing legitimate webmail services.

To mitigate the risks associated with this generic phishing threat, organizations and individuals should implement several security measures. First, ensure that all webmail access points are secured with strong, multi-factor authentication. Second, educate users about the signs of phishing, such as suspicious URLs, unexpected requests for personal information, and unverified SSL certificates. Finally, regularly update security software and firewalls to block known malicious domains and IP addresses, including those listed in reputable blocklists. By taking these steps, users can significantly reduce the likelihood of falling victim to phishing attacks.