bafybeibeooncwnjx3amo2o2swthlvsjll5hcqkjxrwslmvsydqd75ukvvy[.]ipfs[.]infura-ipfs[.]io

Analysis indicates that the domain bafybeibeibeooncwnjx3amo2o2swthlvsjll5hcqkjxrwslmvsydqd75ukvvy.ipfs.infura-ipfs.io is actively serving a high-risk generic phishing campaign targeting Webmail credentials. The domain, registered through GANDI SAS on January 30, 2020, resolves to the IP address 209.94.90.3, located within AS40680 (Protocol Labs) in the United States. Infrastructure analysis reveals the use of Amazon-issued SSL certificates (Amazon RSA 2048 M02) and nameservers associated with AWS (ns-1433.awsdns-51.org, ns-1615.awsdns-09.co.uk, ns-221.awsdns-27.com, and ns-516.awsdns). The site returns an HTTP 301 redirect status, suggesting it may be funneling victims toward a secondary malicious endpoint. Detection metrics confirm the domain's malicious classification: it appears on two security blocklists and is flagged by 20 of 95 security vendors in aggregated scans. Independent trust assessments assign scores of 1/100 and 0/100, reinforcing its high-risk status. Technologies detected on the domain include IPFS, Python, Django, and Cloudflare, alongside HTTP/3 support, which may be leveraged to evade traditional network-based detection mechanisms. The page title explicitly identifies itself as 'Webmail,' indicating an intent to deceive users into submitting email credentials. While the exact content and targeting specifics remain unconfirmed due to lack of direct analysis, the combination of infrastructure, detection history, and thematic indicators strongly suggests an active credential-harvesting operation. Defenders are advised to block the domain at the DNS or network level, monitor for related IPFS hashes or subdomains, and alert users to the risk of credential theft via fraudulent Webmail portals.