start-paybis-com-logn[.]pages[.]dev

This domain, start-paybis-com-logn.pages.dev, is identified as a generic phishing site impersonating the legitimate cryptocurrency exchange Paybis. The site is designed to harvest user credentials by mimicking the official Paybis login portal, specifically targeting German-speaking users with the page title 'Paybis.com Login – Probleme lösen & Zugang schützen.' As of the latest analysis, the domain has been taken offline, though prior activity remains a significant concern for historical exposure. Analysis indicates the domain was registered through Cloudflare, Inc., with a creation date of November 06, 2025, which is anomalous given the current timeline and suggests potential domain spoofing or backdating. It resolved to the IP address 172.66.47.103, a Cloudflare-hosted endpoint, and employed technologies such as HSTS, Cloudflare proxy services, and HTTP/3. The domain was flagged by 3 of 95 security vendors on VirusTotal, indicating limited but confirmed detection. Additionally, it appeared on three security blocklists and was actively blocked by at least three threat intelligence platforms. The SSL certificate was issued by Google Trust Services, a common but not exclusive indicator of legitimacy, which threat actors frequently exploit to lend credibility to fraudulent sites. The Gridinsoft trust score for this domain was 0 out of 100, reinforcing its classification as high-risk infrastructure. The domain is currently offline, reducing immediate exposure risk; however, the infrastructure and tactics observed warrant continued vigilance. Organizations and individuals are advised to monitor for credential reuse attempts, particularly among users who may have interacted with the site prior to its takedown. Network administrators should ensure that the domain and its associated IP (172.66.47.103) are added to blocklists to prevent future access. Users who may have entered credentials on this site should immediately reset their Paybis account passwords and enable multi-factor authentication. Additionally, security teams should review logs for connections to the domain or IP to identify potential compromised accounts within their networks.