your-blockfi[.]webflow[.]io

On 24 July 2026, the domain your-blockfi.webflow.io was observed hosting a credential‑phishing page that uses the page title “BlockFi login”. The site impersonates the BlockFi brand, as indicated by the page title and the identified scam type of credential phishing. The domain was registered on 21 February 2026 through NameCheap, Inc., and is served from the IP address 172.64.151.8, which belongs to AS13335 Cloudflare, Inc., located in the United States. The hosting infrastructure utilizes Webflow, Cloudflare’s CDN, and HTTP/3, and the TLS certificate is issued by Google Trust Services under the WE1 CA, confirming a valid HTTPS configuration. HTTP requests return status code 200, indicating the page is reachable.

Reputation checks show that 16 of 93 security vendors on VirusTotal flag the domain as malicious, and the site appears on one external security blocklist. The domain’s trust score from Gridinsoft is 0 out of 100, and it has been blocked by the PhishDestroy service. Nameservers listed are journey.ns.cloudflare.com and lamar.ns.cloudflare.com. No additional intelligence such as Safe Browsing or OTX identifiers is available. The current active status suggests the phishing infrastructure remains operational.

Uncertainty remains around the exact content of the landing page beyond the title, as no visual analysis has been performed. The lack of further public reports limits insight into whether the page captures credentials or forwards users to additional malicious resources. Defenders should add the domain and its resolved IP address to inbound and outbound filtering rules, monitor DNS queries for the associated nameservers, and ensure that any detection signatures referencing the “BlockFi login” title are updated. Continuous re‑scanning on VirusTotal and inclusion in internal threat‑intel feeds are recommended to track changes in vendor detection ratios.