bafybeibednalgwbl72zf6kml3rrbyabnk2k2nxm6j3szad2lemlagypcda[.]ipfs[.]infura-ipfs[.]io

The domain bafybeibednalgwbl72zf6kml3rrbyabnk2k2nxm6j3szad2lemlagypcda.ipfs.infura-ipfs.io has been identified as a generic phishing threat targeting user credentials, specifically designed to steal login information through a deceptive webmail interface. This domain is currently offline, but its history indicates a clear intent to impersonate legitimate email services to harvest sensitive data. The page title 'Webmail' is a common lure used in credential theft campaigns, and no specific brand is impersonated beyond the generic webmail concept.

PhishDestroy's analysis reveals that this domain was flagged by 20 out of 95 VirusTotal security vendors, a significant detection rate that underscores its malicious nature. The domain was registered on January 30, 2020, through GANDI SAS, and resolves to IP address 209.94.90.3. It appears on 2 security blocklists, and its SSL certificate is issued by Amazon RSA 2048 M02, which may lend a false sense of legitimacy. Despite being taken offline, the domain's infrastructure and registration details provide critical indicators for threat hunting and network defense.

Given that the domain is now offline, the immediate risk is mitigated, but users who may have interacted with it previously should change their passwords and enable multi-factor authentication on any accounts potentially compromised. PhishDestroy recommends monitoring for any re-registration or similar domains, and adding the IP 209.94.90.3 to blocklists. Organizations should also educate users about credential theft tactics involving generic webmail login pages. Continuous vigilance is advised as this domain could resurface under different hosting or registration details.