get-paybise-io-us[.]pages[.]dev

The domain get-paybise-io-us.pages.dev has been confirmed as a generic phishing site. It is designed to impersonate Paybis, a legitimate cryptocurrency trading platform, with the intent of tricking users into providing sensitive information. No specific crypto drainer kit was detected, but the fake login page is a clear indicator of the domain's malicious intent.

Infrastructure analysis reveals that the domain has a VirusTotal detection score of 3/95, indicating that three out of 95 security vendors have flagged this domain as malicious. The domain is registered through Cloudflare, Inc., and resolves to the IP address 172.66.44.123. It was created on November 11, 2025, and currently holds a Gridinsoft trust score of 0/100. The site uses HSTS, Cloudflare, and HTTP/3 technologies, and its SSL certificate is provided by Google Trust Services. The domain appears on three security blocklists and is blocked by MetaMask, PhishDestroy, and SEAL.

The domain is currently offline, which suggests that it has been taken down as part of a response action to mitigate the threat. However, the domain's previous online status and the elevated risk level indicate that there may still be residual risk. Users are advised to avoid visiting this domain and to ensure that any credentials potentially entered on the fake login page are changed immediately. Security teams should monitor for any reactivation of the domain and take appropriate measures to protect their networks and users.