blekfilogen[.]webflow[.]io

This domain, blekfilogen.webflow.io, impersonates the legitimate BlockFi cryptocurrency platform login portal to harvest user credentials. Analysis indicates the page presents a fraudulent login interface titled 'BlóckFi Login! - Access Your Account Securely,' designed to deceive visitors into entering sensitive account details. The threat specifically targets cryptocurrency users, aiming to steal login credentials for unauthorized access to digital asset wallets or exchange accounts, potentially leading to financial theft or further exploitation via crypto drainer attacks.

Technical evidence confirms the domain's malicious intent. As of the latest scan, 16 out of 95 security vendors on VirusTotal flag blekfilogen.webflow.io as malicious. The domain is registered through Webflow, a platform often abused for rapid deployment of phishing pages due to its ease of use and hosting capabilities. Infrastructure analysis reveals the domain resolves to the IP address 104.18.36.248, and it appears on at least one security blocklist. No legitimate creation date is publicly available, but the domain remains active, indicating ongoing threat activity.

Users who have visited blekfilogen.webflow.io or entered credentials on the page should immediately take corrective action. First, revoke access to any associated cryptocurrency accounts and change passwords using a secure, unrelated device. Enable multi-factor authentication (MFA) if not already active. Monitor accounts for unauthorized transactions and report suspicious activity to the legitimate platform. Additionally, scan the device used to access the domain for malware, as phishing pages may deploy secondary payloads. If financial loss is suspected, contact relevant financial institutions or cryptocurrency support teams for further assistance.