blocfi-user-en[.]pages[.]dev

PhishDestroy identifies an active crypto drainer campaign impersonating BlockFi at blocfi-user-en.pages.dev. This fraudulent page mimics the official BlockFi login portal to steal cryptocurrency from unsuspecting users.

This domain poses an immediate and high-risk threat as a crypto drainer phishing page designed to harvest login credentials and session tokens for BlockFi accounts. Upon loading, the page displays a title identical to the legitimate BlockFi login interface: 'BlockFi Login | Official Access to Your Crypto Wallet and Investment Dashboard'. The threat actor leverages Cloudflare’s infrastructure to host the malicious page, which resolves to IP address 188.114.96.3 and utilizes a Google Trust Services SSL certificate to appear legitimate. Threat intelligence shows that 8 out of 95 security vendors on VirusTotal have flagged this domain, highlighting its malicious nature. The domain was registered through Cloudflare, Inc. and remains actively accessible as of the latest investigation.

Users who visited blocfi-user-en.pages.dev or entered any credentials should immediately revoke access to their BlockFi accounts, enable two-factor authentication if not already active, and review recent transaction history for unauthorized activity. Do not reuse passwords from BlockFi on other services. Report the domain to PhishDestroy for takedown and consider using a hardware wallet or cold storage for cryptocurrency holdings. If you provided private keys or seed phrases, transfer remaining funds to a secure wallet immediately and initiate a security audit.