bitmartwlogin[.]webflow[.]io

This domain is flagged for credential phishing, a threat type targeting user authentication data for cryptocurrency exchange platforms. Analysis indicates the domain was designed to impersonate BitMart, a legitimate crypto trading service, to harvest login credentials from unsuspecting victims. The elevated risk level is assigned due to the domain's active exploitation of trust in financial platforms and its prior operational status before takedown. Infrastructure analysis reveals the domain bitmartwlogin.webflow.io was registered through Webflow on May 23, 2026, and resolved to the IP address 172.64.151.8. It was blocked by one security blocklist and flagged by 15 out of 95 security vendors on VirusTotal. The SSL certificate was issued by Google Trust Services (WE1), a common provider for both legitimate and malicious domains. The page title, 'BitMart %^Login - Crypto-Exchange,' further confirms the intent to deceive users into entering sensitive account details. Mitigation steps for this threat type include immediate blocking of the domain and its associated IP address (172.64.151.8) at the network perimeter. Organizations should monitor for credential reuse attempts, particularly for cryptocurrency-related accounts, and enforce multi-factor authentication (MFA) as a secondary defense. End users should be educated on identifying phishing indicators, such as unusual subdomains (e.g., 'webflow.io') in URLs and discrepancies in page titles or branding. If credentials were entered on this domain, affected accounts must be secured by resetting passwords and revoking active sessions.