paycard[.]biz

PhishDestroy identifies paycard.biz as an active generic phishing domain operating as a crypto drainer, designed to steal cryptocurrency from unsuspecting users. The site mimics legitimate payment platforms, likely targeting individuals expecting secure transactions. No specific drainer kit signatures were detected in initial scans, but the domain's behavior aligns with known drainer tactics, including fake login prompts and unauthorized fund transfers. This domain was flagged with a VirusTotal detection score of 0/95, indicating no antivirus engines have yet flagged it as malicious. It was registered through Gname.com Pte. Ltd. on April 13, 2026, and resolves to IP 188.114.96.3. The domain utilizes a Let's Encrypt SSL certificate, which is commonly exploited by threat actors to appear legitimate. As of now, it remains unlisted on major blocklists such as Google Safe Browsing (GSB), with no recorded entries in PhishDestroy's blocklist database. The domain is currently active and under investigation, with risk level marked as under_investigation. Immediate actions include domain takedown requests and IP de-listing efforts. Users are strongly advised to avoid interacting with paycard.biz and verify any suspicious domains through PhishDestroy before proceeding. While the immediate risk is contained through monitoring, the lack of detections and recent registration date suggests potential for escalation if left unchecked.