bitmartloginut[.]webflow[.]io

bitmartloginut.webflow.io is a currently active credential phishing domain designed to mimic the legitimate BitMart cryptocurrency exchange login portal. This site poses a direct threat to users by harvesting login credentials and potentially enabling unauthorized access to victim accounts. The page uses the Webflow.io subdomain platform and displays a fraudulent login form that closely resembles the official BitMart interface, tricking visitors into submitting their email addresses and passwords. Once captured, these credentials are likely used for credential stuffing attacks, unauthorized trading, or further phishing campaigns targeting the victim’s connected accounts.

This domain was flagged by 14 out of 95 VirusTotal security vendors as malicious, indicating a high level of suspicion across the cybersecurity community. The domain is hosted on Cloudflare’s infrastructure at IP address 172.64.151.8 and uses a Google Trust Services SSL certificate to appear legitimate. The site leverages the Webflow.io platform, which is a legitimate web development service, but has been abused to host phishing content. The low detection rate (14/95) suggests that this phishing page is relatively new or employs evasion techniques to avoid detection by automated scanners.

If you visited or entered any information on bitmartloginut.webflow.io, act immediately to secure your accounts. First, change your BitMart password using the official website or app—do not use any links from emails or messages. Enable two-factor authentication (2FA) on your BitMart account and any other platforms where you used the same password. Scan your device for malware using reputable antivirus software, as phishing sites often drop info-stealing trojans. Report the domain to BitMart’s abuse team and consider revoking any API keys or third-party permissions associated with the compromised account. Stay vigilant for follow-up phishing attempts, as attackers may use your email to send more convincing scams.