bafybeigjvbxf7rrgtencanryhquhvdfaxvqegf46shk2utwur3kytohdve[.]ipfs[.]infura-ipfs[.]io

The domain bafybeigjvbxf7rrgtencanryhquhvdfaxvqegf46shk2utwur3kytohdve.ipfs.infura-ipfs.io was observed hosting a generic phishing payload and is currently listed as offline. Registration data shows it was created on January 30, 2020 through GANDI SAS, and the domain resolves to the IP address 209.94.90.3, which belongs to AS40680 owned by Protocol Labs in the United States. The hosting environment uses Amazon DNS infrastructure, as indicated by the four Amazon Route 53 nameservers (ns-1433.awsdns-51.org, ns-1615.awsdns-09.co.uk, ns-221.awsdns-27.com, ns-516.awsdns). The SSL certificate presented is issued by Amazon, identified as Amazon RSA 2048 M02, confirming the use of Amazon cloud services for TLS termination.

HTTP requests to the site returned status code 451, indicating unavailable for legal reasons, which aligns with the current offline status. Threat intelligence sources report that 15 of 95 security vendors on VirusTotal flagged the domain, and it appears on one external blocklist. PhishDestroy has actively blocked the domain, and the Scamadviser trust score is 1 out of 100, reflecting an extremely low credibility rating. The only visible page element is the title "Webmail," providing no further context about the targeted service.

While the domain’s infrastructure and detection history are well documented, the exact phishing campaign content, target audience, and any associated malware or credential harvesting mechanisms remain unknown due to the offline state. Defenders should continue to block the domain at network perimeter devices, update URL filtering lists with the full hostname, and monitor for any reappearance of the same IP or certificate fingerprint. Additional analysis should focus on correlating the 15 vendor detections to identify shared indicators of compromise, and on tracking any future registrations that reuse the same IP or DNS infrastructure for similar phishing attempts.