bmartdecfi[.]xyz

bmartdecfi.xyz was observed hosting a page titled “BitMart DeFi Wallet Airdrop”. The domain was registered through NiceNIC International Group Co., Limited on 23 February 2026 and is delegated to the Cloudflare nameservers clyde.ns.cloudflare.com and jasmine.ns.cloudflare.com. DNS resolution points to 172.67.203.96, an address owned by AS13335 Cloudflare, Inc., located in the United States. TLS is provided by a Let’s Encrypt certificate (issuer “E7”), indicating the site used HTTPS with HTTP/3 support. VirusTotal records show that 6 of 93 scanned security vendors flagged the domain, reflecting a modest but non‑trivial detection rate.

The domain appears on four independent blocklists – PhishDestroy, MetaMask, ScamSniffer and SEAL – all of which classify it as a crypto‑related scam. The intelligence tags the activity as an “Airdrop Scam” phishing kit, targeting users of the BitMart DeFi wallet. The site has been taken offline at the time of analysis (status: offline). No additional payloads, redirects, or credential‑harvesting forms have been captured, so the exact mechanics of the attack remain unclear. Defenders should assume that the domain was used to lure victims into providing wallet credentials or private keys under the pretense of an airdrop.

Network‑level controls should block traffic to 172.67.203.96 and to any hostnames resolving to Cloudflare‑issued IPs that are listed on the four blocklists. Endpoint detection should monitor for attempts to connect to the domain or to download the Airdrop Scam kit, and threat‑intel feeds should be updated to include the domain and its associated indicators. Because the domain is currently offline, ongoing monitoring for re‑registration or resurrection on a different IP address is recommended. In summary, bmartdecfi.xyz exhibits typical characteristics of a crypto‑phishing campaign: recent registration, Cloudflare hosting, a valid TLS certificate, and inclusion on multiple anti‑phishing blocklists.