Phishing Analysis: BlockFi

Visual Capture

Screenshot of homepege--blackfi--login--auth.webflow.io

Detection Info

http://homepege--blackfi--login--auth.webflow.io/

Detected Brand

BlockFi

Country

USA

Confidence

95%

HTTP Status

200

Report ID

6186b658-e55…

Analyzed

2026-03-17 16:54

Final URL (after redirects)

https://homepege--blackfi--login--auth.webflow.io/

Content Hashes (HTML Similarity)

Used to detect similar phishing pages based on HTML content

Algorithm	Hash Value
CONTENT TLSH	T17D71A51BD1E8104D161702E57DB230ADC65681EFF3E6DD446CF0E20DB3E8A95227E955
CONTENT ssdeep	96:gCdhD6GP4Sxlw/r4R3V4R1t4R74RX4RW0EdxGu2XDMWeON1r:gCTDrP4SxlwT4RF4R1t4R74RX4Rod4zv

Visual Hashes (Screenshot Similarity)

Used to detect visually similar phishing pages based on screenshots

Algorithm	Hash Value
VISUAL pHash	e46e93d9690b926c
VISUAL aHash	fb97b333f3f7ffff
VISUAL dHash	cb25674626c4dbb6
VISUAL wHash	39131333f373031f
VISUAL colorHash	07002000180
VISUAL cropResistant	cb25674626c4dbb6,7a5d5c6f66636d0c

Code Analysis

Risk Score 53/100

Threat Level ALTO

⚠️ Phishing Confirmed

🎣 Credential Harvester

🔬 Threat Analysis Report

• Threat: Phishing
• Target: BlockFi users
• Method: Impersonation using a look-alike website on free hosting.
• Exfil: Likely steals login credentials and potentially financial information.
• Indicators: Free hosting, brand logo present.
• Risk: HIGH

🔒 Obfuscation Detected

fromCharCode

📊 Risk Score Breakdown

Total Risk Score

90/100

Contributing Factors

Free Hosting

The site is hosted on a free platform (webflow.io), which is commonly abused by phishers.

Brand Impersonation

The site is attempting to look like the legitimate BlockFi website.

Obfuscation

Obfuscation detected in javascript code

🔬 Comprehensive Threat Analysis

Threat Type

Credential Harvesting Kit

Target

BlockFi users (USA)

Attack Method

Brand impersonation + credential harvesting forms + obfuscated JavaScript

Exfiltration Channel

Form submission (backend endpoint not detected - likely JavaScript-based)

Risk Assessment

MEDIUM - Automated credential harvesting with Form submission (backend endpoint not detected - likely JavaScript-based)

⚠️ Indicators of Compromise

Kit types: Credential Harvester
2 obfuscation techniques

🏢 Brand Impersonation Analysis

Impersonated Brand

BlockFi

Official Website

https:

Fake Service

BlockFi Login

⚔️ Attack Methodology

Primary Method: Credential Harvesting

The phishing site is designed to trick users into entering their BlockFi login credentials, which are then harvested by the attackers.

🌐 Infrastructure Indicators of Compromise

Domain Information

Domain

homepege--blackfi--login--auth.webflow.io

Registered

None

Registrar