homepage-btimart-auth-o[.]webflow[.]io

The domain homepage-btimart-auth-o.webflow.io imitates the BitMart Exchange login page, aiming to harvest user credentials. Despite being offline now, it was flagged by 16 out of 93 VirusTotal vendors, indicating its malicious intent. The domain was registered through NameCheap, Inc., and hosted on an IP managed by Cloudflare, Inc. in the US.

PhishDestroy identified this phishing domain on February 14, 2026, a week before its official creation date of February 21, 2026. This proactive detection underscores the importance of early threat identification, as phishing domains often exploit the gap between registration and widespread detection by antivirus databases. The site used SSL issued by Google Trust Services, which can lend an air of legitimacy to unsuspecting users.

The site is designed to deceive BitMart users into entering their login credentials, potentially compromising their accounts and associated financial assets. The presence of the domain on a public blocklist further confirms its malicious nature. While the site is currently offline, its initial activity highlights the ongoing threat of phishing schemes targeting cryptocurrency platforms. Such operations can have significant financial repercussions for victims, emphasizing the need for continual monitoring and swift action against emerging threats.