bitmart-spot[.]com

Analysis of the domain bitmart-spot.com indicates a high-risk brand impersonation campaign targeting Ethereum users. The domain was registered on August 5, 2025, through Tucows Domains Inc. and remains active as of July 12, 2026. It resolves to IP address 104.21.60.237, a Cloudflare-hosted endpoint utilizing HTTP/3, which may complicate traditional network-based detection methods. The page title, 'BitMart - Cryptocurrency Exchange | Buy & sell Bitcoin, Ethereum, Tether instantly,' explicitly mimics the branding of a legitimate cryptocurrency exchange, aligning with the reported threat type of brand impersonation. Threat intelligence sources confirm the domain's malicious classification. AlienVault OTX lists it in 50 threat intelligence pulses, while it appears on three security blocklists, including PhishDestroy, PhishingDB, and BLP-Malware. Seventeen of 95 security vendors on VirusTotal flag the domain as malicious. Additional risk indicators include a Scamadviser trust score of 1/100 and a Gridinsoft trust score of 0/100, reinforcing its high-risk status. The SSL certificate is issued by Google Trust Services, which may lend a superficial appearance of legitimacy but does not mitigate the underlying threat. Defenders should treat this domain as actively malicious. Network-level blocking of 104.21.60.237 and the domain itself is recommended. Given the impersonation of a cryptocurrency exchange, users should be alerted to the risk of credential theft or fraudulent transactions. The domain's continued activity and Cloudflare infrastructure suggest it may persist unless proactively disrupted. Further analysis of associated infrastructure or historical DNS records may reveal additional linked domains or campaigns.