bitmartxlogink[.]webflow[.]io

This domain is flagged as an elevated-risk credential phishing portal targeting cryptocurrency users. Analysis indicates the site impersonates a legitimate exchange platform through a fake login interface, designed to harvest user credentials for unauthorized account access or subsequent crypto drainer attacks. The page title, 'Bitmart🅡 login🅡 | Learn trading strategies - access crypto account,' employs Unicode characters to mimic the authentic brand while evading basic detection mechanisms. Infrastructure analysis reveals the domain bitmartxlogink.webflow.io was registered on February 21, 2026, through NameCheap, Inc., a registrar frequently observed in phishing campaigns. The domain resolves to IP address 104.18.36.248, hosted on Cloudflare's network (AS13335), a common obfuscation tactic to conceal origin servers. At the time of assessment, 20 out of 95 security vendors on VirusTotal flagged the domain as malicious, while one additional blocklist has incorporated it. The SSL certificate, issued by Google Trust Services (WE1), provides a false sense of legitimacy, though certificate transparency logs confirm its recent issuance aligns with the domain's creation date. Mitigation against this credential phishing threat requires immediate action from both end-users and security teams. Users should verify domain authenticity by cross-referencing official exchange URLs and enabling multi-factor authentication (MFA) on all cryptocurrency accounts. Security teams are advised to block the domain and its resolving IP (104.18.36.248) at the network perimeter, while monitoring for similar Unicode-based impersonation attempts. Organizations should also implement email filtering rules to detect and quarantine messages containing links to webflow.io subdomains or other platform-as-a-service hosting providers commonly abused for phishing. Given the 20/95 detection rate, endpoint protection should be updated to include this indicator of compromise (IOC) in threat intelligence feeds.