blockfs-login[.]webflow[.]io

This domain, blockfs-login.webflow.io, is identified as a credential_phishing site specifically targeting cryptocurrency users through a fake login portal. The threat impersonates BlockFi, a legitimate cryptocurrency financial services platform, to deceive victims into entering sensitive account credentials. As of the latest verification, the domain has been taken offline, though prior activity remains under investigation. Analysis indicates the domain was flagged by 20 of 95 security vendors on VirusTotal, reflecting elevated detection rates. It was registered through Webflow, a platform commonly used for web development, and resolved to the IP address 104.18.36.248, hosted by Cloudflare, Inc. in Canada. The SSL certificate was issued by Google Trust Services (WE1), a detail often exploited to lend false legitimacy. Infrastructure review shows the domain appeared on one security blocklist, and its page title mirrored BlockFi’s official branding: 'BlockFi: Do More With Your Crypto - Buy, Sell, Trade.' The domain’s current offline status reduces immediate risk, though residual threats may persist if credentials were previously harvested. Organizations and individuals are advised to monitor for unauthorized access to cryptocurrency wallets or exchanges linked to BlockFi. Reset passwords for any accounts accessed during the domain’s active period, enable multi-factor authentication, and review transaction logs for anomalies. Security teams should update blocklists to include this domain and its associated IP, while remaining vigilant for similar phishing attempts leveraging Webflow or Cloudflare infrastructure.