paybis[.]eu

This domain, paybis.eu, is currently flagged as an active credit card phishing site targeting users of a legitimate cryptocurrency exchange platform. The domain impersonates the brand to harvest payment card details under the guise of facilitating instant Bitcoin purchases. Analysis confirms the site remains operational and continues to solicit sensitive financial information from unsuspecting visitors. Infrastructure analysis reveals the domain was registered through Wild West Domains, Inc. and resolves to the IP address 188.114.96.3, hosted on Cloudflare's network (AS13335). The site appears on one security blocklist and has been flagged by 4 out of 95 security vendors on VirusTotal. The SSL certificate is issued by Google Trust Services (WE1), a common tactic used to lend false legitimacy to fraudulent sites. The page title, 'Buy Bitcoin with Credit Card or Debit Card Instantly | Paybis,' directly mirrors the branding of the legitimate service, increasing the likelihood of successful deception. Current status indicates the domain remains active and unmitigated, posing a high risk to users. Organizations are advised to block the domain and its associated IP at the network perimeter. Users who may have interacted with the site should immediately revoke any shared payment credentials, monitor financial statements for unauthorized transactions, and report the incident to relevant fraud prevention authorities. Proactive monitoring of related infrastructure is recommended, as threat actors frequently rotate domains and IPs to evade detection.