# PhishDestroy domain threat record: auth-bitbuy--cdn---newzenler.webflow.io

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/auth-bitbuy--cdn---newzenler.webflow.io/
Machine-readable companion: https://phishdestroy.io/domain/auth-bitbuy--cdn---newzenler.webflow.io/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: not observed active
- First observed by PhishDestroy: 2026-09-11 09:48:26 UTC
- Last availability or vendor check: 2026-10-23 01:25:56 UTC
- Stored record updated: 2026-10-23 10:51:50 UTC
- VirusTotal detections in the stored snapshot: 17/89
- Independent public blocklist matches in the stored snapshot: 2
- Matching public blocklists: MetaMask, SEAL
- Google Safe Browsing stored result: flagged

## Stored infrastructure

- Observed IP address: 104.18.36.248
- Registrar in stored WHOIS data: Webflow
- Registrar country in stored WHOIS data: US
- Last stored HTTP status: 404
- Registration date (registry RDAP, webflow.io): 2013-05-08 02:20:57 UTC

## Evidence links

- URLScan report: https://urlscan.io/result/01a08fe3-2cb5-73aa-8464-b1b7d35b90cf/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/auth-bitbuy--cdn---newzenler.webflow.io
- Certificate Transparency search: https://crt.sh/?q=%25.auth-bitbuy--cdn---newzenler.webflow.io
- Web Archive lookup: https://web.archive.org/web/*/https://auth-bitbuy--cdn---newzenler.webflow.io/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
This Webflow-hosted page impersonated Bitbuy, the Canadian cryptocurrency exchange, and carried the title "Log In | Bitbuy" to pass as the real sign-in screen. Its long, cluttered subdomain mixes "auth", "bitbuy" and "cdn" so that a quick glance suggests official authentication infrastructure. PhishDestroy first saw it on 2026-09-11. It has been offline since 2026-09-19 and still served no content at its last check on 2026-10-19.

How the scam works
Victims usually arrive through a link in an email, text message or ad warning about their Bitbuy account. They land on a page that copies the exchange's login form. Anything typed there, including email, password and often a one-time 2FA code, goes to the operators instead of Bitbuy. With a live session, attackers can log in, change security settings and withdraw the victim's crypto or fiat balance before the owner notices.

Evidence
Seventeen of 89 VirusTotal engines flagged the page when it was checked on 2026-09-20. The vendors include crypto-focused ChainPatrol alongside BitDefender, ESET, Emsisoft, Fortinet, Forcepoint ThreatSeeker, alphaMountain.ai and CyRadar. Google Safe Browsing classifies it as social engineering, which triggers warnings in mainstream browsers. MetaMask and SEAL list it next to PhishDestroy, so wallet users and the security community have independently confirmed the verdict.

Infrastructure
Rather than registering its own domain, the operator built the page on a free Webflow subdomain. This lets a phishing page go live in minutes and borrow the trust of a well-known platform. Traffic was served through Cloudflare's network with a location in Canada, matching Bitbuy's home market. The site lasted about eight days after PhishDestroy first saw it, which is typical of disposable pages on site-builder platforms.

What to do
If you entered your Bitbuy login on this page, change your password immediately through the official Bitbuy app or a bookmarked address. Reset your 2FA, review recent logins and withdrawals, and contact Bitbuy support to lock the account if you see anything unfamiliar. Change the password anywhere you reused it, and watch for follow-up messages pretending to be Bitbuy support. Defenders should block lookalike Webflow subdomains that combine exchange brand names with words like "auth" or "cdn", and report new instances to Webflow and the targeted brand.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a08fe3-2cb5-73aa-8464-b1b7d35b90cf/
VirusTotal report: https://www.virustotal.com/gui/domain/auth-bitbuy--cdn---newzenler.webflow.io
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=auth-bitbuy--cdn---newzenler.webflow.io
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-19 10:19:43 UTC

## Stored page captures

- Primary capture: https://urlscan.io/screenshots/01a08fe3-2cb5-73aa-8464-b1b7d35b90cf.png
  Captured: 2026-09-11 09:48:26 UTC
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/ef57fac4-a783-47db-a617-561d0721d099.png
  Captured: 2026-09-18 18:11:47 UTC
  Source report: https://radar.cloudflare.com/scan/ef57fac4-a783-47db-a617-561d0721d099
  SHA-256: a380e448eb3101674f4c67f891f37ba29b76e79d0bcca3163d4b1510d947431b

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-20T23:44:10Z",
        "uuid": "01a08fe3-2cb5-73aa-8464-b1b7d35b90cf",
        "scanned_at": "2026-09-11T09:53:52Z",
        "final_url": "https://auth-bitbuy--cdn---newzenler.webflow.io/",
        "status": 200,
        "ip": "172.64.151.8",
        "domains": [
            "cdn.prod.website-files.com",
            "d3e54v103j8qbb.cloudfront.net"
        ],
        "ips": [
            "13.226.247.129",
            "104.18.160.117",
            "172.64.151.8"
        ],
        "asns": [
            "16509",
            "13335"
        ],
        "countries": [
            "US"
        ],
        "link_domains": [
            "biby-buy.xyz",
            "webflow.com"
        ],
        "doc_hash": "324dd713ea15c10ca87f999499481295023b5e56b19f6f950cdb13db13afb8bf",
        "globals": [
            "$",
            "jQuery",
            "tram",
            "Webflow"
        ],
        "tls": {
            "san": [
                "webflow.io",
                "*.webflow.io"
            ],
            "cipher": "AES_128_GCM",
            "issuer": "WE1",
            "subject": "webflow.io",
            "protocol": "QUIC",
            "valid_to": "2026-10-23T03:21:05Z",
            "valid_from": "2026-07-25T02:21:21Z"
        },
        "domain_age_days": 0,
        "apex_age_days": 0,
        "tls_age_days": 48,
        "tls_valid_days": 90,
        "requests": 8,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 100,
                "malicious": true
            },
            "overall": {
                "score": 0,
                "malicious": false
            }
        },
        "headers": {
            "server": "cloudflare",
            "content-type": "text/html; charset=utf-8",
            "content-security-policy": "frame-ancestors 'self' https://*.webflow.com http://*.webflow.com http://*.webflow.io http://webflow.com https://webflow.com"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-20T22:34:28Z",
        "uuid": "ef57fac4-a783-47db-a617-561d0721d099",
        "scanned_at": "2026-09-18T18:11:47Z",
        "final_url": "https://auth-bitbuy--cdn---newzenler.webflow.io/",
        "status": 404,
        "redirected": "https-only",
        "history": [
            {
                "url": "http://auth-bitbuy--cdn---newzenler.webflow.io/",
                "status": 307
            },
            {
                "url": "https://auth-bitbuy--cdn---newzenler.webflow.io/",
                "status": 404
            }
        ],
        "dom_hash": "4932075438459d054af6b75a0d6585b123ae775f36579c095159b2af33360488",
        "doc_hash": "90c032f35272ba1a7aa93027ab635e6610d4f24cf9e53c0624d00f065d7c7e7d",
        "url_risks": [
            "Phishing"
        ],
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "auth-bitbuy--cdn---newzenler.webflow.io",
                "type": "A",
                "value": "104.18.36.248"
            },
            {
                "name": "auth-bitbuy--cdn---newzenler.webflow.io",
                "type": "A",
                "value": "172.64.151.8"
            },
            {
                "name": "auth-bitbuy--cdn---newzenler.webflow.io",
                "type": "AAAA",
                "value": "2a06:98c1:3102::ac40:9708"
            },
            {
                "name": "auth-bitbuy--cdn---newzenler.webflow.io",
                "type": "AAAA",
                "value": "2a06:98c1:3105::6812:24f8"
            }
        ],
        "dnssec_valid": false,
        "ip": "104.18.36.248",
        "verdict": {
            "tags": [
                "phishing"
            ],
            "malicious": true,
            "categories": [
                "phishing"
            ]
        },
        "whois": {
            "registrar": "MarkMonitor Inc.",
            "created": "2013-05-08T02:20:57Z",
            "updated": "2026-08-12T04:04:30Z",
            "expires": "2028-05-08T02:20:57Z",
            "nameservers": [
                "lamar.ns.cloudflare.com",
                "journey.ns.cloudflare.com"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-22T06:17:04Z",
        "analysis_at": "2026-09-12T00:16:25Z",
        "stats": {
            "timeout": 0,
            "harmless": 42,
            "malicious": 17,
            "suspicious": 0,
            "undetected": 33
        },
        "detections": {
            "ESET": "phishing",
            "VIPRE": "phishing",
            "G-Data": "phishing",
            "Lionic": "phishing",
            "Sophos": "phishing",
            "CyRadar": "phishing",
            "Webroot": "malicious",
            "Emsisoft": "phishing",
            "Fortinet": "phishing",
            "Netcraft": "malicious",
            "Kaspersky": "phishing",
            "LevelBlue": "phishing",
            "BitDefender": "phishing",
            "ChainPatrol": "malicious",
            "alphaMountain.ai": "phishing",
            "Google Safe Browsing": "phishing",
            "Forcepoint ThreatSeeker": "phishing"
        },
        "reputation": 0,
        "tags": [
            "dga"
        ],
        "categories": {
            "Sophos": "phishing and fraud",
            "Webroot": "Phishing and Other Frauds",
            "alphaMountain.ai": "Phishing (alphaMountain.ai)",
            "Forcepoint ThreatSeeker": "web hosting"
        },
        "registrar": "MarkMonitor Inc.",
        "created": "2013-05-08T02:20:57Z",
        "expires": "2028-05-08T02:20:57Z",
        "updated": "2026-08-12T04:04:30Z",
        "first_seen": "2026-09-11T09:48:31Z",
        "dns": [
            {
                "ttl": 300,
                "type": "AAAA",
                "value": "2a06:98c1:3105::6812:24f8"
            },
            {
                "ttl": 300,
                "type": "AAAA",
                "value": "2a06:98c1:3102::ac40:9708"
            },
            {
                "ttl": 300,
                "type": "A",
                "value": "104.18.36.248"
            },
            {
                "ttl": 300,
                "type": "A",
                "value": "172.64.151.8"
            }
        ],
        "dns_at": "2026-09-12T00:16:49Z",
        "jarm": "27d27d27d00027d00042d43d00041df04c41293ba84f6efe3a613b22f983e6",
        "cert": {
            "san": [
                "webflow.io",
                "*.webflow.io"
            ],
            "issuer": "Google Trust Services / WE1",
            "serial": "7e5a9322f440be460e62bc877c41833c",
            "sha256": "a4ffdefa8d99689893e2aafdf9588b6f8f2f8ec47698ea534dbfa409dbbde19d",
            "subject": "webflow.io",
            "valid_to": "2026-10-23T03:21:05Z",
            "valid_from": "2026-07-25T02:21:21Z"
        },
        "whois": {
            "registrar": "MarkMonitor Inc.",
            "registrar_iana_id": "292",
            "registrar_url": "http://www.markmonitor.com",
            "created": "2013-05-08T02:20:57Z",
            "updated": "2025-02-25T20:53:31Z",
            "expires": "2028-05-08T02:20:57Z",
            "status": [
                "clientDeleteProhibited",
                "clientTransferProhibited",
                "clientUpdateProhibited"
            ],
            "nameservers": [
                "journey.ns.cloudflare.com",
                "lamar.ns.cloudflare.com"
            ],
            "dnssec": "unsigned"
        }
    }
}
```