blocfk-filogin[.]gitbook[.]io

The domain blocfk-filogin.gitbook.io has been identified as a brand impersonation threat specifically targeting BlockFi users through a fake login page. Currently marked as offline, this domain was designed to deceive visitors into entering sensitive credentials under the guise of a legitimate BlockFi portal. PhishDestroy confirms the site is no longer accessible, but its prior activity posed a significant risk to anyone who may have encountered it.

Analysis of the domain reveals it was flagged by 15 of 95 VirusTotal security vendors, indicating broad consensus on its malicious nature. The domain was registered through Cloudflare, Inc. and created on March 30, 2014, though its phishing activity appears more recent. It resolves to IP address 104.18.40.47 and uses an SSL certificate from Google Trust Services (WE1). Additionally, the domain appears on 2 security blocklists, further corroborating its threat status. The page title observed was "BlóckFi | Login," a clear attempt to mimic the legitimate BlockFi interface.

Given that the domain is now offline, the immediate risk of credential theft is reduced. However, users who may have previously visited the site should change their BlockFi passwords and enable two-factor authentication as a precaution. PhishDestroy recommends avoiding any unsolicited login links and always verifying URLs directly through official channels. Staying vigilant against similar impersonation attempts is crucial for maintaining account security.