paybiss-io-logn[.]pages[.]dev

This domain, paybiss-io-logn.pages.dev, operates as a credential theft site specifically targeting users of the Paybis cryptocurrency exchange platform. The site presents a fraudulent login interface mimicking Paybis.com, using the page title 'Paybis.com Login | Sicherer Zugriff auf Ihr Krypto-Konto' to deceive victims into entering their account credentials. Analysis indicates the primary objective is to harvest login details for unauthorized access to cryptocurrency wallets and associated financial assets, with potential secondary risks including malware distribution or follow-up social engineering attacks.

Technical evidence confirms the malicious nature of this domain. VirusTotal reports 4 out of 95 security vendors flagging the domain as malicious, while it appears on three distinct security blocklists. The domain was registered through Cloudflare, Inc. on November 10, 2025, and resolves to the IP address 172.66.47.14. Infrastructure analysis reveals the use of Google Trust Services for SSL certification, alongside detected technologies including HSTS, Cloudflare, and HTTP/3. The domain's creation date aligns with recent phishing campaign patterns targeting cryptocurrency platforms, and its immediate takedown suggests proactive detection by security systems.

Users who visited paybiss-io-logn.pages.dev and entered credentials should immediately revoke access to any linked cryptocurrency wallets or exchange accounts. Change all passwords associated with the compromised credentials, particularly those used for financial or cryptocurrency services. Enable multi-factor authentication on all critical accounts, using hardware-based or app-based authenticators rather than SMS. Monitor account activity for unauthorized transactions and report any suspicious activity to the legitimate platform. Consider freezing credit reports if personal information was submitted, and scan local devices for malware using updated security tools to detect potential secondary infections.