bitmartblogin[.]webflow[.]io

This domain, bitmartblogin.webflow.io, operates as a credential phishing page designed to harvest cryptocurrency exchange login credentials. The page mimics the legitimate BitMart platform, presenting users with a visually identical login interface under the title 'BitMart Login - Secure Access to Your Crypto Universe.' Once entered, credentials are transmitted to threat actors, enabling unauthorized access to victim accounts, fund theft, and further exploitation of linked financial services. The domain specifically targets users of the BitMart exchange, leveraging urgency and familiarity to bypass security awareness. Analysis indicates the domain was registered on February 21, 2026, through NameCheap, Inc., and is hosted on infrastructure associated with Cloudflare, Inc. (AS13335), resolving to the IP address 104.18.36.248. Security vendor detection on VirusTotal stands at 13 out of 95 engines, while the domain appears on one security blocklist. The SSL certificate, issued by Google Trust Services (WE1), provides a false sense of legitimacy, though the creation date and hosting context align with known phishing infrastructure patterns. Users who visited bitmartblogin.webflow.io should immediately revoke any entered credentials by changing their BitMart password and enabling multi-factor authentication on their account. All connected devices should be scanned for malware, and any sessions linked to the phishing domain should be terminated. If financial transactions were initiated after credential exposure, affected parties should contact their exchange support team to report unauthorized activity and request account freezing. Monitoring for suspicious login attempts or unauthorized withdrawals is strongly advised.