bulocdxfilogin[.]gitbook[.]io

The domain bulocdxfilogin.gitbook.io is flagged for credential phishing and is currently offline. The threat impersonates BlockFi, a known cryptocurrency platform, to deceive users into revealing their login credentials. This domain poses an elevated risk to users who may encounter it during routine online activities.

Infrastructure analysis reveals that bulocdxfilogin.gitbook.io is registered through Cloudflare, Inc. and resolves to the IP address 104.18.40.47, located in the United States (AS13335 Cloudflare, Inc.). The domain was created on February 21, 2026, and has been flagged by 17 of 95 security vendors on VirusTotal. Additionally, the domain appears on one security blocklist, specifically PhishDestroy, and is secured with an SSL certificate issued by Google Trust Services / WE1. These indicators suggest a concerted effort to appear legitimate and evade detection.

The domain is currently offline, which may indicate that the malicious activity has been disrupted or that the threat actors have moved on to other targets. Security teams and users are advised to remain vigilant and report any similar suspicious domains. Organizations should update their security policies to include warnings about BlockFi impersonation attempts and educate users on recognizing and avoiding phishing attacks. Regularly monitoring domain registrations and IP resolutions can help in early detection and mitigation of such threats.