bitmartxloginj[.]webflow[.]io

This domain, bitmartxloginj.webflow.io, operates as a credential phishing site designed to deceive users into submitting cryptocurrency exchange login credentials. The page presents a fraudulent BitMart login interface, complete with branding elements and input fields for account access, with the intent to harvest sensitive authentication details for unauthorized account takeovers or financial theft. Analysis of the page title, 'BitMart Login🅡 | Cryptocurrency account🅡 access - Guide,' confirms the targeted impersonation of the legitimate BitMart platform, a known cryptocurrency exchange service. Infrastructure analysis reveals multiple technical indicators supporting the malicious classification of this domain. The domain is flagged by 17 out of 95 security vendors on VirusTotal, indicating a consensus among detection engines regarding its phishing nature. Registered through NameCheap, Inc. on February 21, 2026, the domain resolves to the IP address 172.64.151.8, hosted on Cloudflare’s infrastructure (AS13335). The SSL certificate, issued by Google Trust Services (WE1), provides a false sense of security to visitors. Additionally, the domain appears on one security blocklist and is currently offline, though prior activity remains a risk to users who may have interacted with it. Users who visited bitmartxloginj.webflow.io or entered credentials on the site should take immediate action to mitigate potential compromise. First, revoke any active sessions on the legitimate BitMart platform and change passwords using a secure, unrelated device. Enable multi-factor authentication (MFA) if not already active, and monitor the account for unauthorized transactions or configuration changes. If cryptocurrency assets were transferred or accessed, report the incident to the exchange and relevant financial authorities. Given the domain’s use of Cloudflare infrastructure, users should also check for additional phishing attempts via similar subdomains or IP ranges associated with this threat actor.