bitmartlogiene[.]webflow[.]io

bitmartlogiene.webflow.io is currently active and returns HTTP 200. The site presents the page title “BitMart login |- Cryptocurrency Exchange”, indicating an attempt to impersonate the BitMart cryptocurrency exchange login portal. The domain is hosted behind Cloudflare (AS13335) and resolves to 172.64.151.8 in the United States. TLS is provided by Google Trust Services under the WE1 certificate, which is typical for Cloudflare‑protected sites. The domain was created on 08 May 2013 and is registered through MarkMonitor, Inc., a registrar often used for legitimate brands, suggesting possible sub‑domain hijacking or abuse of a previously legitimate name. Security‑vendor scans on VirusTotal show 17 of 91 scanners flagging the host, and Gridinsoft assigns a trust score of 0/100. The domain appears on one public blocklist and is listed by PhishDestroy as blocked. Detected technologies include Webflow, Cloudflare and HTTP/3. The intelligence classifies the activity as a “Fake Exchange” phishing campaign targeting users of the BitMart platform. While the page content has not been directly examined, the combination of a credential‑harvesting title, active hosting, and multiple vendor detections indicates a high‑risk threat. Defenders should block DNS resolution for the domain, add the IP address to network deny lists, and monitor for credential submissions to the URL. Incident response teams should also review logs for any outbound connections to 172.64.151.8 and consider user awareness campaigns about unsolicited BitMart login requests.