blekfilogvn[.]webflow[.]io

This domain is flagged as a credential-harvesting phishing site targeting users of the BlockFi cryptocurrency platform. Analysis indicates the site impersonates the legitimate BlockFi login portal, presenting a high-risk threat to users who may unknowingly submit account credentials, recovery phrases, or other sensitive authentication details. The domain specifically uses the page title 'BlóckFi^* Account Login | Seamlessly Manage Your Assets' to deceive victims into believing they are accessing the official platform. Infrastructure analysis reveals the domain blekfilogvn.webflow.io was registered through Webflow and currently resolves to the IP address 172.64.151.8. The site is served via Cloudflare with HTTP/3 support and uses an SSL certificate issued by Google Trust Services, adding a false sense of legitimacy. Detection metrics show the domain holds a Gridinsoft trust score of 0/100 and appears on one security blocklist. VirusTotal reports 18 out of 95 security vendors have flagged this domain as malicious. The domain has since been taken offline, though historical indicators remain relevant for threat correlation. Mitigation steps for this specific threat type include immediate blocking of the domain and associated IP address (172.64.151.8) at the network perimeter. Organizations should deploy endpoint protection rules to prevent access to Webflow-hosted subdomains exhibiting similar naming patterns or impersonating financial services. Users who may have interacted with this domain should be instructed to reset credentials on the legitimate BlockFi platform using multi-factor authentication and monitor accounts for unauthorized activity. Security teams are advised to review logs for connections to 172.64.151.8 and the domain blekfilogvn.webflow.io, as well as implement detection rules for the unique page title string 'BlóckFi^*' to identify related phishing attempts.