help--auth-bitmart[.]webflow[.]io

This domain, help--auth-bitmart.webflow.io, operates as a credential-harvesting phishing site targeting users of the BitMart cryptocurrency exchange. The site presents a fraudulent login portal designed to mimic the legitimate BitMart interface, capturing usernames, passwords, and potentially two-factor authentication codes. Victims who enter credentials risk immediate account compromise, unauthorized fund transfers, and identity theft within the cryptocurrency ecosystem. The site's infrastructure and visual design closely replicate the official BitMart platform, increasing the likelihood of successful deception among unsuspecting users. Analysis indicates this domain is hosted on Webflow infrastructure and resolves to IP address 172.64.151.8, associated with Cloudflare (AS13335). VirusTotal detection metrics show 19 out of 95 security vendors flagging the domain as malicious, with one confirmed blocklist entry. The page title, 'Log in to your BitMart® account | BitMart® Exchange,' precisely matches the legitimate service's branding, suggesting a deliberate attempt to deceive users through brand impersonation. The domain's registration through Webflow provides anonymity and rapid deployment capabilities for threat actors. Users who have visited help--auth-bitmart.webflow.io should immediately change their BitMart account credentials from a secure device. Enable multi-factor authentication if not already active, and review all recent account activity for unauthorized transactions. Monitor linked email accounts and financial services for suspicious activity, as compromised credentials may facilitate secondary attacks. Security teams should block the domain (help--auth-bitmart.webflow.io) and IP address (172.64.151.8) at the network perimeter, and consider implementing additional monitoring for users who may have interacted with the phishing site. The elevated risk level warrants immediate containment actions to prevent credential reuse across other platforms.