bitmartloginev[.]webflow[.]io

PhishDestroy identifies bitmartloginev.webflow.io as an active credential theft domain currently leveraging brand impersonation against BitMart users. Security telemetry confirms this infrastructure is engaged in live phishing operations designed to harvest login credentials under false pretenses, posing elevated risk to unsuspecting visitors. The domain is currently classified as active with threat status escalated due to confirmed malicious intent and user engagement. This domain was flagged by 19 of 95 VirusTotal vendors, resolves to IP 104.18.36.248, and operates under a Google Trust Services SSL certificate. Infrastructure analysis reveals registration through Cloudflare, Inc., with domain creation occurring within the last 90 days. The site has been listed on one public blocklist and maintains low trust scores across multiple reputation engines. Despite the use of a legitimate web hosting platform (Webflow), the operational context and targeting strategy confirm malicious intent rather than benign use. The threat level remains elevated as bitmartloginev.webflow.io continues to serve fraudulent login portals indistinguishable from legitimate BitMart interfaces. Users attempting to access BitMart services should verify URLs through official channels and enable multi-factor authentication. Organizations are advised to implement network-level blocking of this domain and associated IP addresses, while security teams should monitor for credential leaks and potential follow-on attacks. Immediate action includes updating blocklists, warning affected user bases, and conducting forensic analysis of any potential compromise.