bafybeialtuz2k4c5teshhzdurrzwdqhvfx7ft6j3ctk33ccgau4vpendje[.]ipfs[.]infura-ipfs[.]io

This domain is flagged for hosting a fake Webmail login page designed to harvest credentials. The site impersonates legitimate email portals to trick users into entering usernames and passwords, which are then captured by threat actors. Such generic phishing pages often target corporate or personal email accounts to gain unauthorized access to sensitive communications or further compromise connected services. Analysis indicates the domain was registered through Gandi SAS on January 30, 2020, and is currently offline. It resolves to the IP address 209.94.90.3, hosted under AS40680 (Protocol Labs). The SSL certificate is issued by Amazon RSA 2048 M02. Security vendors on VirusTotal flagged this domain at a rate of 15 out of 95, and it appears on two security blocklists, including PhishDestroy and PhishingDB. The page title explicitly reads 'Webmail,' a common indicator of credential harvesting attempts. If a user visited this domain or entered credentials, immediate action is required. First, change the password for the affected email account and any other services where the same credentials were reused. Enable multi-factor authentication (MFA) if not already active. Monitor the account for unauthorized access or suspicious activity, such as sent emails or login attempts from unfamiliar locations. Scan the device used to access the site for malware, as phishing pages may deploy additional payloads. Report the incident to the organization’s IT security team or a trusted security provider for further investigation.