paybis-logiin-eng-us[.]pages[.]dev

This domain, paybis-logiin-eng-us.pages.dev, is flagged as a generic phishing resource designed to impersonate the legitimate Paybis cryptocurrency exchange platform. Analysis indicates the site specifically targets German-speaking users, as evidenced by the page title 'Paybis Login – Sicher anmelden & Konto verwalten,' which mimics the authentic login interface to deceive victims into submitting credentials. While no explicit drainer kit signatures were identified, the domain exhibits characteristics consistent with credential harvesting campaigns, including the use of Cloudflare’s infrastructure to obscure hosting origins and evade takedowns. Infrastructure analysis reveals multiple technical indicators of malicious activity. The domain was registered on November 7, 2025, through Cloudflare, Inc., and resolves to the IP address 172.66.44.149. Detection metrics show a VirusTotal score of 3/95, with three security vendors explicitly flagging the domain. Additionally, the domain appears on three security blocklists and is actively blocked by wallet security extensions and phishing detection tools. The SSL certificate is issued by Google Trust Services, a common tactic to lend superficial legitimacy to phishing sites. No Google Safe Browsing (GSB) hits were recorded at the time of analysis, suggesting the domain may have evaded initial detection filters. The domain has since been taken offline, likely in response to security vendor reports and blocklist inclusions. However, residual risk remains due to the transient nature of such campaigns. Adversaries frequently rotate domains and IPs to circumvent detection, and the use of Cloudflare’s registrar and hosting services enables rapid redeployment. Users who interacted with the domain prior to its takedown are advised to rotate credentials immediately, particularly those associated with cryptocurrency wallets or financial services. Organizations should monitor for similar impersonation attempts targeting regional users, as the German-language focus may indicate a localized threat actor strategy.