bafybeih6fxh7ch7c4wi2x2jm5m6xteqeogdynpxenl4u4p6vxotkcrruna[.]ipfs[.]infura-ipfs[.]io

The domain bafybeih6fxh7ch7c4wi2x2jm5m6xteqeogdynpxenl4u4p6vxotkcrruna.ipfs.infura-ipfs.io was identified as a credential theft infrastructure, specifically designed to harvest webmail login credentials. The page title 'Webmail' suggests an attempt to impersonate generic email login portals, though no specific brand was confirmed in available intelligence. This domain is currently offline, though prior activity indicates an elevated risk to users who may have interacted with it during its operational window. Analysis of the domain reveals it was flagged by 19 of 95 security vendors on VirusTotal, indicating moderate to high detection rates across the security community. The domain was registered through GANDI SAS on January 30, 2020, and resolves to the IP address 209.94.90.2, located in the United States under AS40680 (Protocol Labs). It appears on two security blocklists, including PhishDestroy and PhishingDB. The SSL certificate is issued by Amazon (Amazon RSA 2048 M02), which, while not inherently malicious, is commonly leveraged in phishing campaigns to lend an appearance of legitimacy. Current infrastructure analysis confirms the domain has been taken offline, reducing immediate risk to end users. However, organizations and individuals should remain vigilant for residual threats, such as cached pages or secondary domains linked to the same infrastructure. Network defenders are advised to block the domain and its associated IP (209.94.90.2) at the perimeter, and monitor for any attempts to re-establish the domain or related subdomains. Users who may have entered credentials on this site should immediately reset passwords and enable multi-factor authentication on all accounts. Security teams should review logs for connections to the domain or IP to identify potential compromise.