home-pay-bis[.]pages[.]dev

This domain, home-pay-bis.pages.dev, is identified as a credential phishing site targeting users of cryptocurrency wallet services. The page impersonates a legitimate login portal, presenting a German-language interface titled 'Páybis Login — Sichern Sie den Zugriff auf Ihre Krypto-Wallet,' designed to harvest authentication credentials from unsuspecting victims. Analysis indicates the site specifically mimics platforms associated with cryptocurrency management, increasing the likelihood of financial loss for affected users.

Infrastructure analysis reveals the domain was registered on November 4, 2025, through Cloudflare, Inc., and resolves to the IP address 172.66.45.32. Detection metrics confirm its malicious nature, with 3 out of 95 security vendors on a major detection platform flagging the domain as phishing-related. Additionally, the domain appears on three distinct security blocklists, and its trust score is rated at 0/100 by independent assessment tools. The site employs HTTP/3 and HSTS, leveraging Cloudflare’s infrastructure to obscure its origin and enhance perceived legitimacy.

Users who accessed this domain or entered credentials are advised to immediately revoke any exposed login details and monitor associated cryptocurrency wallets for unauthorized transactions. It is recommended to conduct a full security audit of devices used to access the site, including malware scans and verification of installed browser extensions. Affected individuals should report the incident to relevant financial and cybersecurity authorities to assist in tracking and mitigating further threats.