bitmart-giris[.]com

Analysis of the domain bitmart-giris.com reveals a brand impersonation attack targeting users of the cryptocurrency platform Bitmart. Currently, the domain has been taken offline, but its recent activity and registration details indicate a clear phishing operation. The site was designed to mimic the legitimate Bitmart login page, as evidenced by the page title 'Bitmart Login | Bitmart Hesabınıza Güvenli Giriş Yapın', which is a Turkish phrase meaning 'Bitmart Login | Securely Access Your Bitmart Account'. This lures victims into entering their credentials, leading to account compromise.

The domain was registered on August 6, 2025 through NiceNIC International Group Co., Limited, a registrar known for being used in malicious campaigns. It resolves to IP address 95.129.234.137, which hosts other suspicious domains. The SSL certificate was issued by Let's Encrypt (R12), a legitimate certificate authority, but this does not validate the site's intent. Security blocklists have already flagged this domain, and VirusTotal reports that 2 out of 95 security vendors mark it as malicious. This low detection rate suggests the domain may have evaded some initial scans, but its inclusion on at least one blocklist confirms its dangerous nature.

Given that the domain is now offline, immediate action may not be necessary, but users who have recently visited bitmart-giris.com or entered credentials should change their Bitmart passwords and enable two-factor authentication. PhishDestroy recommends monitoring accounts for suspicious activity and using a password manager to avoid reusing credentials. For organizations, blocking the domain and IP at the network level can prevent future access. Always verify URLs before logging in, especially when prompted with urgent language or unfamiliar domain names.