bitmmertlogin[.]webflow[.]io

This domain is flagged as an elevated-risk credential phishing site designed to harvest login credentials for cryptocurrency exchange accounts. Analysis indicates the page mimics BitMart’s official login interface, using the title "BitMart @ Login - Exchange$ | Buy" to deceive victims into entering sensitive authentication details. Infrastructure analysis reveals the domain was created on March 07, 2026, and is registered through MarkMonitor, Inc. It resolves to IP address 172.64.151.8, hosted on Cloudflare’s network (AS13335). Security vendors on VirusTotal flagged the domain 19 out of 95 times, and it appears on one security blocklist. The SSL certificate is issued by Google Trust Services (WE1), a common tactic to lend false legitimacy. The domain was subsequently taken offline but remains a documented threat. Mitigation steps for this specific threat type include blocking the domain and associated IP at network perimeter defenses. Organizations should deploy email and web filtering rules to prevent user access to known phishing infrastructure. End users should be trained to verify domain authenticity before entering credentials, particularly for financial or cryptocurrency platforms. Security teams are advised to monitor for credential reuse attempts stemming from this campaign, as harvested data may be exploited in follow-on attacks.