bitmatlogin[.]webflow[.]io

This domain, bitmatlogin.webflow.io, is actively engaged in credential phishing targeting cryptocurrency users by impersonating the BitMart exchange login portal. Analysis of the page title, "BitMart Login: Secure Access to Your Crypto Univers𝐞," reveals an attempt to mimic the legitimate BitMart brand, likely to harvest login credentials for unauthorized access to user accounts. The use of a Unicode character (𝐞) in the title suggests an effort to evade basic detection mechanisms while maintaining visual similarity to the authentic site. No direct evidence of a crypto drainer kit was observed, but the credential harvesting infrastructure could facilitate subsequent unauthorized transactions or account takeovers. Technical indicators confirm the domain's malicious nature. The domain is flagged by 19 out of 95 security vendors on VirusTotal, with a presence on one security blocklist and blocked by PhishDestroy. It is registered through Webflow and resolves to the IP address 104.18.36.248, hosted on Cloudflare's infrastructure (AS13335). The domain's creation date is not explicitly provided, but its registration via Webflow aligns with common phishing tactics leveraging legitimate hosting services to evade initial scrutiny. Google Safe Browsing (GSB) status is not specified, but the domain's detection rate and blocklist inclusion indicate a recognized threat. The domain remains active as of this report, posing an elevated risk to users who may be deceived by its spoofed interface. Immediate response actions should include blocking the domain at the network level, notifying affected users, and monitoring for credential reuse across other platforms. Despite its detection by multiple security vendors, the domain's continued operation underscores the persistent risk of credential phishing campaigns. Users are advised to verify domain authenticity before entering credentials, enable multi-factor authentication (MFA) on cryptocurrency accounts, and report suspicious domains to relevant security teams for further investigation.