will-blockfi[.]webflow[.]io

Analysis indicates that the domain will-blockfi.webflow.io is actively hosting a credential phishing campaign targeting BlockFi users. The domain was registered on March 7, 2026, through Webflow, a platform commonly used for both legitimate and malicious web projects. Infrastructure analysis reveals the site is served via Cloudflare (AS13335), resolving to the IP address 172.64.151.8, located in the United States. The page title, 'BlockFi | Login,' explicitly suggests an attempt to mimic the official BlockFi login portal, aligning with the credential phishing classification provided in available threat intelligence. The domain is flagged by 19 of 94 security vendors on VirusTotal, a detection rate consistent with known phishing activity. It appears on at least one security blocklist and is actively blocked by PhishDestroy. The Gridinsoft trust score of 0/100 further corroborates its malicious classification. The SSL certificate is issued by Google Trust Services (WE1), a common certificate authority that does not inherently validate the legitimacy of the site’s content. Technologies detected include Webflow as the hosting platform and Cloudflare for content delivery, with HTTP/3 support enabled. The site remains operational as of July 12, 2026, returning an HTTP 200 status code, indicating active hosting. While the exact content of the page has not been manually verified, the combination of domain naming, page title, and detection data strongly suggests it is designed to harvest BlockFi user credentials. Defenders should treat this domain as high-risk and prioritize blocking it at the network level. Users encountering this domain should avoid entering any credentials and report the site to their security teams. Further investigation into the Webflow account and associated infrastructure may reveal additional linked phishing domains.