help--auth-bitmart[.]webflow[.]io

help--auth-bitmart.webflow.io is a subdomain of webflow.io. PhishDestroy first recorded this hostname on Mar 17, 2026. The hostname explicitly references Bitmart; stored content metadata identifies the same apparent target. The stored content classification is fake exchange. The assembled evidence scores 100/100 (critical).

Four independent sources are positive: VirusTotal, Cloudflare Radar, URLQuery, and URLScan. VirusTotal recorded 19 detections among 94 engines: ADMINUSLabs, alphaMountain.ai, BitDefender, Chong Lua Dao, CyRadar, ESET, Emsisoft, Forcepoint ThreatSeeker, Fortinet, G-Data, Gridinsoft, Kaspersky, LevelBlue, Lionic, Netcraft, Seclookup, Sophos, VIPRE, Webroot on Jul 18, 2026 at 18:45 UTC. Cloudflare Radar classified the hostname as malicious and assigned the categories phishing and security threats; its verdict timestamp was not retained. URLQuery recorded 2 threat-system alerts on Mar 18, 2026 at 00:30 UTC. URLScan returned a malicious verdict with score 100 on Mar 24, 2026 at 11:13 UTC. The evidence is not unanimous. The external blocklist snapshot contained no matches on Aug 7, 2026 at 18:20 UTC. Google Safe Browsing returned no flag on Mar 17, 2026 at 14:18 UTC. PhishStats returned no feed match on Mar 17, 2026 at 14:19 UTC.

An access-restricted HTTP 403 response was recorded on Aug 7, 2026 at 01:03 UTC. Registration records for the registrable domain webflow.io list Webflow as the registrar and Mar 16, 2026 as the creation date. Registration preceded first observation by 0 days. At collection time, the hostname resolved to 172.64.151.8 on AS13335 (CLOUDFLARENET - Cloudflare, Inc., US). The associated network metadata labels the endpoint as AS13335 Cloudflare, Inc. in San Francisco, US. The stored server header is cloudflare. Captured page title: “Log in to your BitMart® account | BitMart® Exchange”. DOM analysis completed on Mar 23, 2026 at 23:10 UTC; stored DOM score 0/100. The evidence archive retains 2 visual captures from PhishDestroy and URLQuery. IoC extraction completed on Aug 1, 2026 at 04:22 UTC; stored 0 format-validated wallet addresses and 0 Telegram indicators. TLS metadata lists WE1 as the certificate issuer with validity through Aug 25, 2026.

The 0/100 DOM score means that the DOM pass stored no scored indicators; it does not negate the independent source findings. Taken together, the page content and independent findings support classifying this hostname as Bitmart-themed fake exchange.