bitmmarttlogin[.]webflow[.]io

The domain bitmmarttlogin.webflow.io is currently active and has been classified as a credential phishing infrastructure with an elevated risk rating. Technical analysis shows the domain resolves to the IP address 172.64.151.8, which is hosted on a Webflow platform. The registration record indicates the site was created through Webflow, a legitimate website‑building service often abused for malicious hosting. DNS queries return no identifiable nameserver entries (NS_NOT_FOUND), suggesting either a misconfiguration or intentional obfuscation of the authoritative name servers.

The domain appears on one public security blocklist and is actively blocked by the PhishDestroy feed, confirming that at least one defensive community has recognized it as malicious. VirusTotal scans reveal that 12 of 91 security vendors have flagged the domain, providing additional independent confirmation of its malicious nature. No further intelligence such as page title, brand targeting, or SSL certificate details is presently available, leaving the exact visual content and impersonated brand unverified.

Defenders should add the domain and its associated IP address to local blocklists, monitor DNS queries for lookups to 172.64.151.8, and ensure that email filtering rules flag any messages containing URLs that reference bitmmarttlogin.webflow.io. Because the site is hosted on a popular SaaS platform, rapid takedown requests to Webflow’s abuse team may be an effective remediation step. Continuous re‑evaluation is advised as additional telemetry, such as page content or user reports, becomes available.