bafybeif3ixjydo2gj7coj7j6tkvqv76l6vp5ckpry4oknuqoucsf4hipc4[.]ipfs[.]infura-ipfs[.]io

This domain bafybeif3ixjydo2gj7coj7j6tkvqv76l6vp5... is currently classified as a high‑risk generic phishing site. The host resolves to IP 209.94.90.3, which belongs to AS40680 (Protocol Labs) and is located in the United States. The site is served over HTTPS with an Amazon RSA 2048 M02 certificate, indicating use of Amazon’s certificate infrastructure. HTTP responses return a 301 redirect and the service stack includes IPFS, Python, Django, Cloudflare, and HTTP/3, suggesting a modern web application hosted on a decentralized storage gateway. Registration data shows the domain was created on 30 January 2020 through GANDI SAS and is managed by four AWS name servers. Reputation services assign a Gridinsoft trust score of 0/100 and a Scamadviser score of 1/100, and the domain appears on two public blocklists (PhishDestroy, PhishingDB). VirusTotal analysis reports 19 of 95 security vendors flag the domain, reinforcing the malicious assessment. The page title returned by the server is “Webmail”, but no additional content has been captured, leaving the exact phishing payload unknown. Defenders should block the domain at network perimeter, add the associated IP to deny lists, and monitor for any traffic that matches the identified technology stack. Continuous re‑assessment is advised because the active status may change and further indicators could emerge.