began-paybis-login-eng-us[.]pages[.]dev

The domain began-paybis-login-eng-us.pages.dev is flagged as a credential phishing site, targeting users of the Paybis brand. Analysis of the domain reveals no known drainer kit usage, indicating that the site may be using a standard phishing template to capture user credentials.

Infrastructure analysis reveals the domain has a VirusTotal detection score of 0/95, suggesting it has not been flagged by antivirus solutions at the time of analysis. The domain is registered through Cloudflare, Inc., and resolves to the IP address 188.114.96.3. It was created on October 31, 2025. The Gridinsoft trust score for this domain is 0/100, indicating a high level of risk. The site appears on 3 security blocklists, including MetaMask, PhishDestroy, and SEAL. The SSL certificate is issued by Google Trust Services, and the site employs HSTS and HTTP/3 technologies.

The current status of the domain is offline, which may indicate that it has been taken down by security researchers or hosting providers. Despite this, the potential risk remains if the domain is reactivated. It is recommended that users who may have visited this site before it was taken down change their Paybis login credentials immediately and monitor their accounts for any unauthorized activity. Security teams should continue to monitor the domain for reactivation and update blocklists and security policies accordingly.