bafybeifo2pid4d2xyk7cc2rncpemph3kljg5ylnovhdmdvw4khoq3uzlya[.]ipfs[.]infura-ipfs[.]io

This domain is flagged as a generic phishing threat designed to impersonate legitimate Webmail login portals. Analysis indicates the site presents a fraudulent interface to harvest user credentials, likely targeting corporate or personal email accounts. The threat leverages social engineering tactics to deceive visitors into entering sensitive information, which is then transmitted to malicious actors for unauthorized access or further exploitation. Infrastructure analysis reveals the domain was registered on January 30, 2020, through GANDI SAS and is hosted on IP 209.94.90.3, associated with a US-based autonomous system. Detection data shows 23 out of 95 security vendors on VirusTotal flagged the domain as malicious, while it appears on two independent blocklists. The SSL certificate, issued by Amazon RSA 2048 M02, does not mitigate the risk, as phishing sites commonly use valid certificates to appear legitimate. If a user visited this domain or entered credentials, immediate action is required. Disconnect the affected device from the network to prevent potential data exfiltration. Reset passwords for any accounts accessed via the fraudulent site, prioritizing email and financial services. Enable multi-factor authentication where available. Monitor accounts for unauthorized activity and report the incident to relevant security teams or fraud reporting platforms. Users should verify the legitimacy of any login portal by checking the URL and SSL certificate details before entering credentials.