bitmartplogin[.]webflow[.]io

PhishDestroy identifies bitmartplogin.webflow.io as an active credential phishing domain designed to harvest BitMart exchange user credentials. The rogue site uses a spoofed login interface on the Webflow.io platform to deceive victims into entering their exchange credentials, which are then exfiltrated to attacker-controlled servers. This tactic is typical of modern credential drainers that mimic legitimate exchange login flows to bypass traditional email filters and endpoint protections. The domain leverages a convincing UI resembling BitMart’s official portal, increasing the likelihood of user deception and successful account takeovers. bitmartplogin.webflow.io resolves to IP 104.18.36.248 and is flagged by 19 of 95 VirusTotal security vendors. The domain operates under Google Trust Services SSL, enhancing its appearance of legitimacy. This domain was created recently and hosted on Webflow’s infrastructure, a common tactic to rapidly deploy phishing campaigns with minimal technical overhead. Despite its recent creation, the domain has already been blacklisted by multiple threat intelligence platforms, underscoring its malicious intent and high-risk profile. As of this assessment, bitmartplogin.webflow.io remains active and poses an elevated risk to users attempting to access BitMart services. Immediate response actions include blocking the domain at DNS and network levels, revoking any TLS certificates associated with the IP range, and updating endpoint protection rules to detect and block access. Users should avoid accessing this domain and verify any BitMart login links through official channels only. Although mitigation measures are in place, the domain’s active status and convincing impersonation mean residual risk remains high for unaware users.