bitmurtilognus[.]webflow[.]io

Analysis of bitmurtilognus.webflow.io confirms its classification as a crypto phishing site targeting BitMart users, with elevated risk indicators across multiple security layers. The domain, hosted on Cloudflare infrastructure (AS13335, IP 172.64.151.8), presents a page title explicitly referencing 'BitMart Login*: Buy Bitcoin & Crypto,' directly aligning with the known brand impersonation of BitMart, a cryptocurrency exchange. Infrastructure analysis reveals the domain was registered through MarkMonitor, Inc. on May 8, 2013, though its malicious use appears to be recent, as indicated by its presence on one security blocklist and detection by PhishDestroy. The SSL certificate, issued by Google Trust Services (WE1), provides no inherent trust signal due to the domain's fraudulent nature. Scamadviser assigns a trust score of 1/100, further corroborating its malicious intent.

Twelve of ninety-five security vendors on VirusTotal flag the domain as malicious, though the absence of additional context limits attribution to a specific phishing kit or campaign. The domain is currently offline, returning an HTTP 404 status, which may indicate takedown efforts or temporary suspension by the hosting provider. Cloudflare nameservers (journey.ns.cloudflare.com, lamar.ns.cloudflare.com) and HTTP/3 support suggest the use of modern, resilient hosting practices commonly exploited by threat actors to evade detection. No evidence links this domain to broader phishing networks or command-and-control infrastructure, though its alignment with crypto scams is clear from the page title and brand target.

Defenders should treat this domain as confirmed malicious, particularly in environments where BitMart or cryptocurrency-related services are accessed. Blocking the domain at DNS and network levels is recommended, alongside monitoring for related subdomains or newly registered lookalike domains.