sso-blockfee[.]webflow[.]io

This domain, sso-blockfee.webflow.io, is actively flagged as a high-risk credential phishing site targeting BlockFi users, as indicated by its page title 'BlockFi login' and confirmed scam classification. Registered on April 28, 2026, through Webflow, the domain resolves to IP 172.64.151.8, hosted on Cloudflare infrastructure in Canada. Infrastructure analysis reveals the use of Webflow for hosting, Cloudflare for CDN and security services, and HTTP/3 for connectivity, which may obscure origin details. The domain lacks configured nameservers, a potential red flag for ephemeral or misconfigured phishing infrastructure. SSL certificate issued by Google Trust Services (WE1) provides encryption but does not validate legitimacy, as phishing sites commonly use valid certificates. The domain is currently active, returning an HTTP 200 status, and appears on at least one security blocklist, with 18 of 91 security vendors on VirusTotal flagging it as malicious. Trust scores from Gridinsoft and Scamadviser are both 1/100, further indicating high risk. Defenders should prioritize blocking this domain at DNS, proxy, and endpoint levels, and monitor for credential submission attempts or related C2 callbacks. The exact phishing kit or post-compromise behavior is not yet analyzed, but the domain’s structure and hosting choices align with common credential harvesting tactics.