auth-sso-bitmart[.]webflow[.]io

The domain auth-sso-bitmart.webflow.io is flagged as a credential phishing site targeting users of the BitMart platform. The page title observed, "BitMart® Login® - Secure & Convenient Access to Your Digital," directly references the legitimate brand, confirming the intent to harvest credentials. Technical analysis shows the site is built on Webflow and is fronted by Cloudflare, leveraging HTTP/3 for transport. The hosting resolves to IP address 104.18.36.248, which belongs to Cloudflare's AS13335 network and is geolocated in the United States. Registration information indicates the domain was created on February 21, 2026 through NameCheap, Inc., a registrar commonly used for disposable domains.

The TLS certificate is issued by Google Trust Services under the WE1 identifier, providing a valid HTTPS connection that may lend false credibility to users. HTTP response code 200 confirms the page is reachable and serving content. Reputation data shows the domain appears on one security blocklist and is actively blocked by PhishDestroy. Gridinsoft assigns a trust score of 0 out of 100, reflecting extreme malicious confidence. VirusTotal analysis records 15 detections out of 93 scanned engines, reinforcing the phishing classification.

While the page content beyond the title has not been publicly dissected, the convergence of brand‑spoofing title, reputable hosting, valid SSL, and multiple vendor detections establishes a high‑risk profile. Defenders should block the domain at perimeter firewalls, update URL filtering feeds with the observed indicators, and monitor for any outbound credential submissions to the associated IP. Incident response teams encountering login attempts to this domain should treat them as compromised and advise affected users to reset their BitMart credentials immediately. Ongoing vigilance is advised, as the attacker may replicate the infrastructure on additional subdomains or rotate IP addresses behind Cloudflare's network.