app-paybis-com-login[.]pages[.]dev

This domain is confirmed to be engaged in brand impersonation, specifically targeting the Bitcoin brand. The risk level is currently under investigation, as the domain has been taken offline, but it remains a potential threat due to its recent creation and use of trusted infrastructure.

Analysis indicates that the domain app-paybis-com-login.pages.dev resolved to the IP address 172.66.44.109 and was registered through Cloudflare, Inc. on October 31, 2025. The site impersonated the Bitcoin brand, as evidenced by the page title 'Bitcoin sofort mit Bankkonto kaufen | Paybis'. Despite its offline status, the domain has been listed on three security blocklists and has a Gridinsoft trust score of 0/100. According to VirusTotal, the domain had 0/95 detections, indicating that it has not yet been flagged by most security engines. The SSL certificate was issued by Google Trust Services, and the site employed HSTS, Cloudflare, and HTTP/3 technologies, which may have lent it an air of legitimacy.

To mitigate the risks associated with this brand impersonation threat, users are advised to verify the authenticity of any Bitcoin-related login pages by cross-referencing the URL with official sources. Security teams should monitor for any复活 (Note: The last part seems to be mistakenly in Chinese, so it should be corrected to English)复活 should be: re-emergence of the domain and update their blocklists accordingly. Additionally, implementing DNS-based blocking and educating users about the dangers of fake login pages can help prevent successful impersonation attacks.