en-pay-bis-com[.]pages[.]dev

This domain poses a direct threat as a fake cryptocurrency login portal impersonating Paybis.com, a legitimate digital asset exchange. Analysis indicates the page was designed to harvest user credentials, potentially enabling unauthorized access to crypto wallets or facilitating fraudulent transactions. The German-language title, 'Paybis.com Login | Sicherer Zugriff auf Ihr Krypto-Konto,' specifically targets German-speaking users, increasing the risk of credential theft from unsuspecting victims familiar with the authentic Paybis platform.

Infrastructure analysis reveals multiple high-confidence indicators of malicious activity. The domain was registered on November 04, 2025, through Cloudflare, Inc., and resolves to the IP address 172.66.45.44. Despite its recent creation, the domain has already been flagged by 1 of 95 security vendors on VirusTotal and appears on 3 distinct security blocklists. Additional technical indicators include the use of Cloudflare hosting, HTTP/3 protocol, and a Google Trust Services SSL certificate, which collectively suggest an attempt to mimic legitimate infrastructure while evading detection.

Users who visited this domain should immediately revoke any sessions or credentials entered on the page. It is recommended to monitor associated crypto wallets for unauthorized transactions and enable multi-factor authentication on all financial accounts. Given the domain's offline status, further forensic analysis may be limited, but affected users should report the incident to relevant cybersecurity authorities and consider freezing compromised accounts to prevent additional fraud.