bluckffillogii[.]godaddysites[.]com

The domain bluckffillogii.godaddysites.com has been identified as a generic_phishing threat, specifically impersonating the cryptocurrency platform BlockFi. The page title, 'BlóckFi Login,' mimics the legitimate BlockFi login interface, indicating an intent to deceive users into submitting credentials. As of the latest assessment, the domain is offline, though prior activity suggests it was actively used for malicious purposes. Analysis of the domain reveals it was flagged by 17 of 95 security vendors on VirusTotal, a notable detection rate for phishing infrastructure. The domain was registered through GoDaddy.com, LLC on November 18, 2013, an unusually long registration period that may have been leveraged to lend false legitimacy. It resolves to the IP address 76.223.105.230 and appears on two security blocklists, including PhishDestroy and OISD. The SSL certificate is issued by GoDaddy.com, Inc., a common certificate authority that does not inherently validate the domain's legitimacy. Infrastructure analysis indicates the domain was hosted on a platform known for enabling rapid deployment of phishing pages, further corroborating its malicious intent. The domain is currently offline, reducing immediate risk to users. However, the infrastructure supporting such threats often remains reusable, and similar domains may emerge. Organizations and individuals are advised to block the domain and its associated IP (76.223.105.230) at the network level. Users who may have interacted with the domain should reset credentials for any financial or cryptocurrency platforms, particularly BlockFi, and enable multi-factor authentication where available. Security teams should monitor for indicators of compromise, including unexpected login attempts or unauthorized transactions, and review logs for connections to the domain or IP address.