offical-blockfi-authh[.]webflow[.]io

The domain offical-blockfi-authh.webflow.io has been identified as a credential phishing infrastructure specifically targeting BlockFi users. Analysis indicates this is a brand impersonation threat designed to harvest login credentials through a fraudulent login portal. The domain is currently offline, though prior activity confirms malicious intent. Infrastructure analysis reveals the domain was flagged by 18 of 95 security vendors on VirusTotal, indicating widespread detection. It was registered through NameCheap, Inc., with a creation date of February 21, 2026, suggesting an attempt to appear legitimate through a future-dated registration. The domain resolves to IP address 172.64.151.8, hosted on AS13335 (Cloudflare, Inc.), and appears on one security blocklist. The SSL certificate is issued by Google Trust Services (WE1), and the page title, "BlockFi™ Login | Log in to my Account™," directly mimics the official BlockFi branding. Current status confirms the domain has been taken offline, though residual risk remains for users who may have interacted with it prior to deactivation. Organizations are advised to monitor for unauthorized access attempts tied to BlockFi credentials and implement multi-factor authentication (MFA) for all financial accounts. Network defenders should block the domain and associated IP (172.64.151.8) at the perimeter, while users should verify the authenticity of any login portal before entering sensitive information. Historical indicators, including the SSL certificate issuer and registrar details, may assist in identifying related phishing infrastructure.