home--en-bitmart--cdn[.]webflow[.]io

This domain, home--en-bitmart--cdn.webflow.io, is identified as a credential phishing site targeting users of the BitMart cryptocurrency exchange. The page replicates the official BitMart login interface, as indicated by the title 'Log in to your BitMart® account | BitMart® Exchange,' with the intent to harvest user credentials. No specific drainer kit signatures were observed, but the domain follows common phishing infrastructure patterns, including the use of a content delivery network to obscure hosting origins. Analysis indicates the domain resolves to IP address 172.64.151.8, hosted on infrastructure associated with a known CDN provider in California. The SSL certificate is issued by Google Trust Services (WE1), a common practice among phishing sites to appear legitimate. VirusTotal detections show 18 out of 95 security vendors flagging the domain as malicious. The domain is registered through Webflow, a platform frequently abused for rapid phishing deployment. It appears on one security blocklist and is currently blocked by at least one anti-phishing service. No creation date was provided, but the domain's structure suggests recent registration. The domain has been taken offline, reducing immediate risk to users. However, residual threats remain, including potential reuse of harvested credentials or redeployment of similar infrastructure under new domains. Organizations should monitor for credential reuse attempts and update blocklists to include related indicators. Users who accessed the site should assume credential compromise and initiate password resets on legitimate platforms. Continuous monitoring of related subdomains or IP ranges is recommended to detect further abuse.