bitmttgin[.]webflow[.]io

This domain is flagged for hosting a generic phishing infrastructure designed to mimic the BitMart cryptocurrency exchange login portal. Analysis indicates the page titled 'BitMart Login: How to Access Your Account Securely' is a credential harvesting endpoint, posing an elevated risk to users attempting to access legitimate financial services. The threat type is classified as generic_phishing, with a focus on stealing account credentials through deceptive authentication interfaces. Infrastructure analysis reveals the domain bitmttgin.webflow.io resolves to IP address 104.18.36.248, hosted on Cloudflare, Inc. (AS13335) infrastructure in the United States. The domain was registered on February 21, 2026, through NameCheap, Inc., and is currently offline. Security vendor detection on VirusTotal shows 14 out of 95 engines flagging the domain as malicious. The domain appears on one security blocklist, and its SSL certificate is issued by Google Trust Services (WE1). The creation date discrepancy suggests potential domain age manipulation to evade detection. Mitigation requires immediate blocking of the domain and its resolving IP (104.18.36.248) at network perimeter controls. Organizations should deploy indicators of compromise (IOCs) to endpoint detection systems, including the domain, IP, and associated SSL certificate fingerprint. User awareness training should emphasize verifying domain authenticity before entering credentials, particularly for financial platforms. Security teams are advised to monitor for credential reuse attempts from harvested accounts and implement multi-factor authentication (MFA) as a compensatory control for affected users.