biitmartlogins[.]webflow[.]io

This domain, biitmartlogins.webflow.io, is identified as a brand impersonation phishing site targeting users of the Bitcoin exchange BitMart. Analysis indicates the page title explicitly mimics the legitimate BitMart login portal, presenting itself as 'BitMart® Login: Exchange | buy & Sell Bitcoin@ | Webflow.' The threat type is classified as credential harvesting, with the intent to deceive victims into entering sensitive account information, which could lead to unauthorized access and financial theft. Infrastructure analysis reveals the domain resolves to IP address 104.18.36.248, hosted on Cloudflare's network (AS13335) in the United States. The domain is registered through Webflow, a platform commonly abused for rapid phishing deployment. On VirusTotal, 18 out of 95 security vendors flag the domain as malicious. It appears on one security blocklist, specifically PhishDestroy, and no Google Safe Browsing (GSB) detection is recorded at the time of analysis. No creation date is available, but the use of Webflow suggests recent, low-effort registration. As of the latest verification, biitmartlogins.webflow.io has been taken offline, likely following abuse reports or automated takedown processes. However, the elevated risk persists due to the domain's prior activity and the potential for threat actors to redeploy similar infrastructure. Users who accessed the site should immediately reset credentials for any associated accounts, enable multi-factor authentication, and monitor for unauthorized transactions. Organizations should update blocklists to include this domain and its resolving IP to prevent future access attempts.