bafybeibvd45o3zcj7cwhqzszpwbtfyic4p7spfed2kxuizsh4qtdmt2gom[.]ipfs[.]infura-ipfs[.]io

This domain, bafybeibvd45o3zcj7cwhqzszpwbtfyic4p7spfed2kxuizsh4qtdmt2gom.ipfs.inffs.infura-ipfs.io, is identified as a credential theft operation impersonating Webmail services. Analysis indicates the infrastructure was designed to harvest login credentials through a fraudulent Webmail interface, with no evidence of crypto drainer functionality or brand-specific impersonation beyond generic email service spoofing. The page title "Webmail" and absence of additional brand markers suggest a broad, opportunistic credential harvesting campaign rather than targeted brand abuse. Infrastructure analysis reveals the domain was registered via GANDI SAS on January 30, 2020, and resolves to the IP address 209.94.90.3, hosted under AS40680 (Protocol Labs). The SSL certificate is issued by Amazon RSA 2048 M02, a common provider for both legitimate and malicious domains. The domain is flagged by 16 out of 95 security vendors on VirusTotal, appears on two security blocklists, and is explicitly blocked by PhishDestroy and PhishingDB. No Google Safe Browsing (GSB) detection was noted in the available data, though this may reflect delayed synchronization rather than absence of malicious classification. As of the latest verification, the domain has been taken offline, likely due to hosting provider intervention or registrar enforcement. However, the underlying infrastructure—including the IPFS gateway and associated hosting—remains accessible, posing a residual risk for redeployment. Users who interacted with the domain prior to takedown should assume credential exposure and initiate password resets for any accounts accessed during the period of activity. Organizations are advised to monitor for reuse of this IPFS content identifier (CID) or similar infrastructure across other gateways, as the decentralized nature of IPFS complicates complete mitigation.