blekfilogon[.]webflow[.]io

On 24 July 2026, security analysts examined the domain blekfilogon.webflow.io, which was observed hosting a page titled “BlóckFi* Account Login: Seamlessly Manage Your Assets”. The title explicitly references BlockFi, indicating a brand‑impersonation attempt aimed at the cryptocurrency‑lending service. The domain was registered on 21 February 2026 through NameCheap, Inc., and resolves to the IP address 172.64.151.8, which belongs to AS13335 operated by Cloudflare, Inc. The hosting infrastructure reports the use of Webflow as the site builder and HTTP/3 over Cloudflare’s edge network. The TLS certificate presented is issued by Google Trust Services under the identifier WE1, confirming a valid HTTPS configuration despite the malicious intent. Detection data show that the domain appears on one external security blocklist and has been flagged by PhishDestroy.

VirusTotal analysis records 16 of 93 scanning engines labeling the host as malicious, reflecting a moderate consensus among vendors. Gridinsoft assigned a trust score of zero out of one hundred, effectively classifying the site as entirely untrusted. The HTTP response returned a 404 status code, and the current operational state is reported as offline, indicating that the phishing page has been taken down or is otherwise inaccessible. Evidence confirms the impersonation of BlockFi and the classification of the campaign as an investment‑scam vector. No additional technical artifacts such as malicious payloads, command‑and‑control endpoints, or credential‑harvesting scripts were disclosed in the available intelligence.

Consequently, the precise content of the page and any user‑interaction mechanisms remain unknown. Defenders should immediately add blekfilogon.webflow.io to URL filtering rules across web gateways and endpoint protection solutions. Monitoring of DNS queries for the associated IP range (172.64.0.0/16) is advised, as Cloudflare‑hosted infrastructure is frequently reused by threat actors.