credit-blockfi[.]webflow[.]io

Analysis indicates the domain credit-blockfi.webflow.io was used in a credential theft operation impersonating the BlockFi login portal. The infrastructure mimics a financial authentication page to harvest user credentials, with the page title 'BlockFi | Login' suggesting brand impersonation of a crypto finance service. Hosting on Webflow indicates use of legitimate SaaS infrastructure to stage phishing content and reduce immediate suspicion.

Infrastructure telemetry shows VirusTotal scoring of 18/95 security vendors flagging the domain. The resolved IP address is 104.18.36.248, operated under AS13335 Cloudflare, Inc., indicating proxied delivery via CDN infrastructure. The domain was created on March 12, 2026 and registered through Webflow, with SSL certificate issued as WE1. External intelligence lists the domain on 1 security blocklist, confirming active malicious classification during its operational period.

At time of analysis, the domain is reported as taken offline following detection and enforcement actions, including blocking by PhishDestroy. Despite takedown status, historical indicators confirm it was an elevated-risk credential harvesting page. Residual risk persists through potential clones or redeployments under similar infrastructure patterns. Users are advised to verify login portals independently, avoid credential entry on unsolicited pages, and rely on bookmarked or official navigation paths to mitigate impersonation risk.