bitmriott-login[.]webflow[.]io

The domain bitmriott-login.webflow.io has been identified as a credential phishing threat. The phishing site was designed to impersonate BitMart, a digital asset management platform, in an attempt to harvest user login credentials. This domain has now been taken offline, mitigating immediate threats to user security.

Upon security analysis, this domain was flagged by 19 out of 95 VirusTotal security vendors, indicating a significant level of detection across various security platforms. The domain was registered through Webflow and resolved to IP address 172.64.151.8, located in the United States under AS13335 with Cloudflare, Inc. It appears on one known security blocklist and was actively blocked by PhishDestroy. These factors underscore the elevated risk associated with the domain while it was active.

Given its offline status, immediate threat activity from bitmriott-login.webflow.io has ceased. However, users who may have interacted with this domain are advised to immediately change any potentially compromised credentials and monitor their accounts for unusual activity. Security teams should ensure domains impersonating well-known brands are actively monitored and reported. Additionally, maintaining up-to-date threat intelligence feeds can enhance proactive detection capabilities, preventing further exposure to similar phishing threats.