bitmogin[.]webflow[.]io

Analysis of the domain bitmogin.webflow.io indicates it was actively involved in a brand impersonation campaign targeting Bitcoin users, specifically mimicking the BitMart cryptocurrency exchange. The domain, hosted on Cloudflare infrastructure (IP 172.64.151.8, AS13335), was registered on March 6, 2026, through MarkMonitor, Inc., a registrar commonly associated with legitimate enterprises but occasionally exploited for phishing operations. The page title, 'BitMart @ Login - Exchange | Buy & sell Bitcoin,' directly references BitMart, reinforcing the intent to deceive users into believing they were accessing an official exchange platform. As of July 23, 2026, the domain resolves to a 404 HTTP status, suggesting it has been taken offline, though its prior activity remains a concern.

Nineteen of 94 security vendors on VirusTotal flagged the domain as malicious, a detection rate consistent with known phishing or scam infrastructure. The domain also appears on at least one security blocklist, further corroborating its classification as a threat. The SSL certificate, issued by Google Trust Services (WE1), is typical for Cloudflare-hosted sites and does not inherently indicate legitimacy or malicious intent.

While the exact content of the site was not analyzed, the combination of a cryptocurrency-themed page title, a known brand target (Bitcoin), and the scam type (fake exchange) aligns with tactics used in credential harvesting or fraudulent transaction schemes. Defenders should treat this domain as part of a broader campaign and monitor for related infrastructure, particularly domains registered through the same registrar or hosted on similar Cloudflare IP ranges. Organizations are advised to block access to bitmogin.webflow.io and review logs for prior interactions with this domain to assess potential exposure.