bitmart-s[.]sbs

The domain bitmart-s.sbs was registered on October 21, 2025 through GRANSY S.R.O D/B/A SUBREG.CZ and is currently active. The site presents the page title "Ray Ecommerce Solutions" but no further content analysis is available. The registration details and the recent creation date align with typical infrastructure used for short‑lived phishing operations.

Infrastructure analysis shows the domain resolves to the IP address 94.154.35.60, which is hosted in the Netherlands and belongs to AS202412 operated by Omegatech LTD. The web server is identified as Nginx and the site serves a Let's Encrypt R12 SSL certificate, a common choice for quickly deployed malicious sites. The presence of multiple nameservers (ns.gransy.com through ns5.gransy.com) suggests the registrar is providing redundant resolution, a pattern observed in other active phishing campaigns.

Detection data indicates that the domain is flagged by at least one security blocklist (PhishDestroy) and appears on a single blocklist overall. VirusTotal reports that 13 of 95 security vendors have flagged the domain, reinforcing the suspicion of malicious intent. Independent reputation services assign low trust scores: Scamadviser rates the domain at 31 out of 100 and Gridinsoft scores it at 0 out of 100, both indicating a high likelihood of abuse. The HTTP response returns a 403 status, which may be employed to hinder automated analysis while still serving malicious content to targeted users.

Defenders should treat bitmart-s.sbs as a high‑risk phishing indicator. Network monitoring should block outbound connections to 94.154.35.60 and any DNS queries for the domain. Email security gateways should add the domain to deny lists and enable URL reputation checks. Continuous monitoring of the associated IP and ASN for new malicious activity is advised, as the infrastructure may be reused for additional campaigns.