paaybilogin[.]pages[.]dev

This domain, paaybilogin.pages.dev, was designed to steal login credentials from Paybis cryptocurrency exchange users. By mimicking the official Paybis login page with a title reading "Paybis Login - Secure Access to Your Crypto Exchange," unsuspecting visitors might enter their email and password, handing them over to attackers. The site posed a serious threat to anyone managing crypto assets, as compromised accounts could lead to financial theft.

PhishDestroy identified this threat through multiple reliable sources. The domain appears on three security blocklists and was flagged by 7 out of 95 security vendors on VirusTotal, a clear sign of malicious intent. It was created on November 6, 2025, and registered through Cloudflare, Inc., using an SSL certificate from Google Trust Services to appear legitimate. The domain resolved to IP address 188.114.97.3 before being taken offline. Its recent creation date and rapid takedown suggest a targeted, short-lived phishing campaign.

If you visited paaybilogin.pages.dev and entered any credentials, change your Paybis password immediately and enable two-factor authentication. Also update passwords on any other accounts where you reuse the same credentials. Monitor your accounts for unauthorized activity and consider contacting Paybis support. For future protection, always double-check URLs before logging in and avoid clicking links in unsolicited messages. Staying vigilant is key to avoiding credential theft.