blockkfilogin9[.]godaddysites[.]com

The domain blockkfilogin9.godaddysites.com is identified as a credential phishing site impersonating BlockFi, a well-known cryptocurrency platform. No specific drainer kit has been identified; however, the domain's structure and page title suggest a deliberate attempt to mimic BlockFi's official login page to deceive users into divulging their credentials.

Infrastructure analysis reveals that the domain is registered through GoDaddy.com, LLC and was created on February 21, 2026. The domain resolves to the IP address 13.248.243.5, which is located in the United States and is part of the Amazon.com, Inc. network (AS16509). The SSL certificate is issued by GoDaddy.com, Inc. under the Go Daddy Secure Certificate Authority - G2. This domain has been flagged by 17 out of 95 security vendors on VirusTotal, indicating a significant level of suspicion. Additionally, it appears on 2 security blocklists, specifically PhishDestroy and PhishingDB, and has been marked as offline.

The current status of the domain is offline, which suggests that it has been taken down either by the registrar, hosting provider, or security organizations. Despite this, the elevated risk level remains due to the potential for the domain to be reactivated or for similar domains to be registered by the same threat actor. It is recommended that users who may have interacted with this domain change their BlockFi account passwords immediately and enable two-factor authentication if not already in place. Organizations should continue to monitor for similar domain registrations and ensure that their network defenses are updated to block any future attempts.