paybiz[.]webflow[.]io

This domain, paybiz.webflow.io, is identified as a brand impersonation phishing site targeting users of the Paybis cryptocurrency exchange platform. The page title, "Paybis: Trusted Cryptocurrency Exchange Platform," directly mimics the legitimate service to deceive visitors into submitting credentials or transferring assets. Analysis indicates the domain is currently offline, though prior activity aligns with credential harvesting or crypto drainer schemes. Infrastructure analysis reveals the domain was created on May 08, 2013, though the phishing subdomain likely leverages the existing registration for legitimacy. It resolves to the IP address 172.64.151.8 and employs an SSL certificate issued by Google Trust Services, a common tactic to appear secure. The domain is flagged by 2 of 95 security vendors on VirusTotal and appears on three independent blocklists. It is registered through MarkMonitor, Inc., a registrar frequently associated with both legitimate and malicious domains. Additional evidence includes active blocking by MetaMask, PhishDestroy, and SEAL, further confirming its malicious intent. The domain has been taken offline, reducing immediate risk to users. However, similar infrastructure may re-emerge under alternate subdomains or domains. Recommended actions include monitoring for newly registered lookalike domains, enforcing blocklist updates across security tools, and educating users on verifying domain authenticity before interacting with cryptocurrency platforms. Organizations should also review logs for prior connections to 172.64.151.8 or the paybiz.webflow.io subdomain to assess potential exposure.