Warning! There seems to be false webmail logon screen hosted on IPFS to phish credentials!

#1

Hey! Just caught a spam mail of the usual scam of “Your mail quota exceeded, login here to fix it, bla, bla, bla”

What was not usual is that it apparently pointed it to an IPFS resource (after some Google Translate unwinding)…

hXXps://2mqkxtmdchltk7iv5iq6hdtaw4rk4l4yynb5dgwrhq-ipfs-infura--ipfs-io.translate.goog/?_x_tr_hp=bafybeibvzbuwl6bw&_x_tr_sl=auto&_x_tr_tl=en&_x_tr_hl=en-US&#my@email.here

Just a note to let you know.

#2
2 Likes
#3

Looks like they may also be using Infura, might be worth notifying them too.

2 Likes
#4

Thanks for the hint, contacted them both. I’ll keep you posted on findings.

Edit:

After all GTranslate black magic, the final URL is:
hXXps://bafybeibvzbuwl6bw2mqkxtmdchltk7iv5iq6hdtaw4rk4l4yynb5dgwrhq.ipfs.infura-ipfs.io/

It is valid and presents a generic login form to steal credentials.

1 Like