blekfilogan[.]webflow[.]io

Analysis of blekfilogan.webflow.io indicates a high‑risk credential phishing operation. The domain was created on 13 June 2026 and is hosted on a Cloudflare edge node (IP 172.64.151.8, AS13335) that serves content over HTTP/3 with a Google Trust Services / WE1 SSL certificate. Infrastructure fingerprints reveal the use of Webflow as the site builder, confirming the registration through Webflow’s platform. The HTTP response returned a 200 status and the page title "BlóckFi @Login: Access Your Account Securely" aligns with a credential‑phishing lure. Security reputation data shows the domain is blocked by at least one anti‑phishing feed (PhishDestroy) and appears on one additional blocklist. VirusTotal scans reported 19 of 91 security vendors flagging the domain, while Gridinsoft assigned a trust score of 0/100, reinforcing the malicious assessment. Nameserver information is unavailable, indicating possible reliance on default platform DNS. The observable evidence confirms active malicious intent, but details of the hosted content and any associated payloads remain unverified. defenders should block the domain at network borders, monitor DNS queries for the associated IP range, and consider adding the domain to endpoint allow/deny lists. Ongoing surveillance is recommended to detect any changes in hosting or content that could modify the threat profile.