faq-paybislogiin-eng-us[.]pages[.]dev

The domain faq-paybislogiin-eng-us.pages.dev has been identified as a phishing threat, specifically targeting users of the Paybis platform. This domain, posing as a legitimate Paybis login page, is designed to illicitly collect user credentials by misleading victims into entering their personal account information. The presence of the German words 'Anleitung, Probleme & Konto-Wiederherstellung' in the page title suggests a focus on account recovery and troubleshooting, commonly used tactics in phishing schemes to enhance credibility.

Technical analysis of faq-paybislogiin-eng-us.pages.dev reveals several indicators of malicious intent. The domain was created on November 07, 2025, and has a Gridinsoft trust score of 0/100, indicating a total lack of trustworthiness. It resolves to the IP address 172.66.47.132 and is registered through Cloudflare, Inc. Notably, the domain is flagged by 4 out of 95 security vendors on VirusTotal, reinforcing its fraudulent nature. Furthermore, it has been blocked by major security entities such as MetaMask, PhishDestroy, and SEAL, and appears on three security blocklists. These technical details substantiate its classification as a phishing domain.

Currently, the domain is offline, which mitigates immediate risk. However, its prior existence underscores the need for vigilance. The use of Google Trust Services for SSL certification indicates potential misuse of legitimate services to appear trustworthy. Users are advised to avoid domains with similar naming conventions and to ensure they access Paybis services through verified URLs. Security teams should remain alert for any re-emergence of similar threats, given the sophisticated tactics employed in this instance.