bafybeihczcpxvywbbj5ntggfaa4tlv25atott5rwtsx2rybahshk3hr4b4[.]ipfs[.]infura-ipfs[.]io

This domain, hosted on IPFS infrastructure, is a generic phishing threat targeting webmail credentials. With an elevated risk level, it was designed to deceive users into entering login details on a fake Webmail page. The site is now offline, but similar threats remain active. PhishDestroy identifies this as a credential theft campaign, not a crypto drainer or brand impersonation, focusing on harvesting email account access.

Technical indicators paint a clear picture: VirusTotal flagged this domain with 19 out of 95 security vendors, placing it in a high-risk category. The domain was registered through GANDI SAS on January 30, 2020, and resolves to IP address 209.94.90.2. It currently appears on 2 security blocklists. The SSL certificate was issued by Amazon (Amazon RSA 2048 M02), which is legitimate but used here to give a false sense of security. The unique seed bc81ed helps track this specific variant. Despite being offline, the domain's history shows it was actively used for credential theft.

To protect against such threats, users should never enter credentials on pages accessed via IPFS links or unfamiliar domains. Enable two-factor authentication on all email accounts and use a password manager to avoid reusing passwords. If you suspect exposure, change passwords immediately and monitor for unauthorized access. Report similar domains to security teams and blocklist providers. Stay vigilant against phishing campaigns that exploit decentralized hosting to evade traditional takedowns.