auth-bitmrt-m-us[.]webflow[.]io

PhishDestroy has identified auth-bitmrt-m-us.webflow.io as a generic phishing domain specifically targeting BitMart cryptocurrency exchange users. This domain, now taken offline, was designed to harvest login credentials by impersonating the official BitMart login page. Its page title, "Log in to your BitMart® account | BitMart® Exchange," closely mimics the legitimate BitMart interface, increasing the likelihood of user deception.

Technical analysis reveals that the domain was created on February 21, 2026, and registered through NameCheap, Inc. It resolves to IP address 104.18.36.248 and is secured with an SSL certificate from Google Trust Services (WE1). Despite the SSL certificate, the domain is highly malicious, as evidenced by its appearance on one security blocklist and a VirusTotal detection rate of 18 out of 95 security vendors flagging it as malicious. These indicators collectively confirm the domain's intent to commit credential theft.

Given that the domain is now offline, users who may have interacted with it should immediately change their BitMart passwords and enable two-factor authentication. PhishDestroy recommends avoiding any unsolicited login prompts and verifying URLs directly through official channels. Staying vigilant against such phishing attempts is crucial for protecting digital assets.