bitmasritlogin[.]webflow[.]io

This domain, bitmasritlogin.webflow.io, is identified as a credential phishing site specifically targeting users of the Bitmart cryptocurrency exchange platform. The phishing page replicates the legitimate Bitmart login interface, using the page title 'Bitmart Login: Your Secure Access to Global Crypto Trading' to deceive victims into submitting their account credentials. No direct evidence of a drainer kit is present in the current dataset, but the domain’s infrastructure and content strongly suggest intent to harvest login details for unauthorized access to crypto wallets or exchange accounts. Infrastructure analysis reveals the domain was registered on February 21, 2026, through NameCheap, Inc. and resolves to the IP address 104.18.36.248, hosted on Cloudflare’s network (AS13335). Security vendor detections on VirusTotal indicate 18 out of 95 engines flag this domain as malicious, while it appears on one additional blocklist. The SSL certificate is issued by Google Trust Services under the WE1 root, a common observation in both legitimate and malicious sites leveraging Cloudflare’s CDN. Google Safe Browsing (GSB) status is not explicitly listed, but the domain’s presence on PhishDestroy’s blocklist confirms its classification as a phishing threat. As of the latest assessment, bitmasritlogin.webflow.io has been taken offline, reducing immediate exposure risk. However, residual threats persist, including potential reuse of the domain or migration of the phishing kit to alternative infrastructure. Organizations and individuals are advised to monitor for similar domains registered through NameCheap or hosted on Cloudflare, particularly those mimicking cryptocurrency exchange logins. Users who may have interacted with this domain should immediately reset their Bitmart credentials and enable multi-factor authentication (MFA) on all crypto-related accounts. Network-level blocking of the IP 104.18.36.248 and associated domains is recommended for proactive defense.