blockfeelogine[.]webflow[.]io

The domain blockfeelogine.webflow.io has been identified as a phishing infrastructure impersonating BlockFi, a cryptocurrency trading platform, with the intent of conducting an investment scam. The domain is currently offline, but prior analysis confirms its malicious use in brand impersonation targeting users of financial services involving Bitcoin and other digital assets. The page title, 'BlockFi Login l BlockFi Trading Platform to Buy Bitcoin,' explicitly mimics legitimate BlockFi login portals to deceive victims into disclosing credentials or transferring funds under false pretenses. Analysis of the domain reveals multiple technical indicators of compromise. The domain was flagged by 19 of 95 security vendors on VirusTotal, indicating broad recognition of its malicious nature. It was registered through Webflow, a platform commonly exploited for rapid deployment of phishing pages due to its ease of use and hosting capabilities. The domain resolves to the IP address 172.64.151.8, associated with AS13335 (Cloudflare, Inc.), a network frequently leveraged to obscure the true origin of malicious infrastructure. The domain was created on March 04, 2026, and appears on at least one security blocklist. The SSL certificate is issued by Google Trust Services (WE1), which, while not inherently malicious, is often used to lend a false sense of legitimacy to phishing sites. Additional infrastructure analysis reveals the domain was blocked by enterprise-grade threat mitigation systems prior to being taken offline. The current status of blockfeelogine.webflow.io is offline, reducing immediate risk to end users. However, the infrastructure and tactics observed suggest potential for redeployment or reuse of similar domains. Organizations and individuals are advised to implement the following measures: (1) Block the domain and associated IP address (172.64.151.8) at the network perimeter to prevent accidental access; (2) Monitor for newly registered domains with similar naming patterns or impersonating BlockFi or other financial services; (3) Educate users on recognizing phishing attempts, particularly those involving cryptocurrency platforms, by verifying domain authenticity and avoiding unsolicited login requests; (4) Report the domain to relevant security teams and blocklist providers to aid in broader threat mitigation efforts. Given the elevated risk associated with investment scams, continuous vigilance and proactive monitoring of related infrastructure are recommended.