bafkreihujo3bmunbephpn7m6jfuctzqs4s4o55rhftb3gg3gojv2csr6ue[.]ipfs[.]infura-ipfs[.]io

This domain, bafkreihujo3.ipfs.infura-ipfs.io, is identified as a credential theft phishing site targeting users of Rackspace Webmail. The page displays the title 'Rackspace Webmail: Hosted Email for Business,' a direct impersonation of the legitimate Rackspace business email service. Credential theft phishing sites like this one are designed to trick users into entering their login credentials, which are then harvested by threat actors for unauthorized access to corporate email accounts, data exfiltration, or further malicious activities such as business email compromise (BEC) attacks. Analysis indicates this domain was registered on February 27, 2026, through Gandi SAS, an unusual registration date suggesting potential misuse of domain registration systems or future-dated entries. The domain resolves to the IP address 18.233.173.50, hosted on Amazon.com, Inc. infrastructure (AS14618) in the United States. The SSL certificate is issued by Amazon RSA 2048 M02, a common certificate authority used for both legitimate and malicious sites. As of the latest scan, 20 out of 95 security vendors on VirusTotal have flagged this domain as malicious, and it appears on one security blocklist. The domain is currently offline, but its infrastructure remains a potential risk for future abuse. If you visited this domain or entered any credentials, immediate action is required. First, change the passwords for any accounts accessed from the same device or network, prioritizing email and financial accounts. Enable multi-factor authentication (MFA) where available to add an additional layer of security. Monitor accounts for unauthorized activity, such as unfamiliar logins, sent emails, or changes to account settings. If corporate credentials were entered, notify your organization’s IT or security team to investigate potential compromise. Consider scanning the device used to access the site with updated antivirus software to detect any malware or persistent threats. Avoid reusing passwords across multiple accounts, as stolen credentials may be tested elsewhere.