auth-verify-blockfi[.]webflow[.]io

PhishDestroy identifies auth-verify-blockfi.webflow.io as an active credential-phishing domain impersonating BlockFi’s authentication flow. The site uses the Webflow.io platform to host a fake login page aimed at harvesting crypto wallet and exchange credentials for subsequent fund drainage. Security telemetry suggests this operator is leveraging a ready-made drainer kit optimized for BlockFi accounts, likely to siphon stored crypto assets or gain entry to connected financial services.

Technical indicators show this domain resolves to 104.18.36.248 and is currently served over HTTPS backed by a Google Trust Services certificate. The domain, created recently, remains undetected on VirusTotal with 0 detections out of 95 engines, while it already appears on two major blocklists including OpenPhish and OISD. The registrar remains unreported in public WHOIS, and Google Safe Browsing has not yet flagged the URL, indicating a window of exposure for unwary users.

This domain is presently ACTIVE and under active monitoring. OpenPhish and OISD have already taken blocking action. However, with 0 VirusTotal detections and no GSB listing, users remain at elevated risk until broader detection coverage is achieved. Users are advised to verify any BlockFi-related links using PhishDestroy’s real-time scanner before entering credentials or two-factor codes.