homepage-btimart-auth-ohm[.]webflow[.]io

PhishDestroy identifies a credential theft domain posing as a legitimate service to harvest user login details. The domain homepage-btimart-auth-ohm.webflow.io mimics a trusted brand’s authentication portal, tricking victims into submitting sensitive credentials. Security teams should treat this as an active threat due to its deceptive impersonation tactics and potential for widespread compromise. The domain’s structure suggests a targeted campaign against users expecting secure interactions, leveraging a familiar webflow.io subdomain to appear legitimate. Analysis indicates this is not a random phishing attempt but a deliberate credential harvesting operation designed to capture high-value account credentials. This domain shows concerning technical indicators with 0 detections on VirusTotal out of 95 engines as of the latest scan. Hosted on IP address 172.64.151.8, it benefits from a Google Trust Services SSL certificate, increasing its authenticity appearance. The domain currently lacks blocklist presence, allowing it to operate undetected. Further investigation reveals this domain was registered recently, with no historic reputation, and uses the webflow.io platform which may be abused for hosting malicious content. The absence of detections suggests either a newly deployed campaign or evasion techniques employed to bypass initial scrutiny. Users who have visited this domain should immediately check for unauthorized account access and change passwords for any services where the same credentials were reused. Monitor financial accounts and email inboxes for suspicious activity, as stolen credentials may lead to account takeovers or financial fraud. If any information was entered on this site, revoke access via official channels and enable multi-factor authentication where available. Report this domain to your security team and security vendors to improve detection coverage. Stay vigilant for follow-on phishing attempts leveraging the compromised credentials.