helpz-blckfip[.]webflow[.]io

This domain, helpz-blckfip.webflow.io, is identified as a phishing portal specifically targeting users of the BlockFi cryptocurrency platform. The site impersonates the BlockFi login interface under the page title 'BlockFi Login: Streamlined & Enhanced Profits' to deceive victims into submitting sensitive credentials, including usernames, passwords, and potentially two-factor authentication codes. As of the latest assessment, the domain is offline, though its infrastructure remains a documented threat. Analysis of the domain reveals multiple technical indicators of compromise. The domain is flagged by 21 out of 95 security vendors on VirusTotal, indicating a consensus on its malicious nature. It was registered through Webflow and resolves to the IP address 172.64.151.8, which is geolocated to Cloudflare, Inc. in Canada. The SSL certificate is issued by Google Trust Services under the identifier WE1. The domain appears on one security blocklist and was created on April 01, 2026, an anomalous future date suggesting possible manipulation or misconfiguration. Infrastructure analysis further reveals the domain was blocked by PhishDestroy, a known anti-phishing filter. The current status of helpz-blckfip.webflow.io is offline, reducing immediate risk of exposure. However, the domain's infrastructure and historical activity warrant continued monitoring. Organizations and individuals are advised to block the domain and its associated IP address 172.64.151.8 at the network perimeter. Security teams should review logs for any prior connections to this domain or IP, particularly from endpoints with access to cryptocurrency platforms. Users who may have interacted with the site should be instructed to reset credentials immediately and enable multi-factor authentication where available. Given the domain's use of Cloudflare infrastructure, additional scrutiny of similar domains leveraging content delivery networks for malicious purposes is recommended.