sso-paybiss[.]webflow[.]io

This domain, sso-paybiss.webflow.io, is identified as a credential phishing resource specifically designed to impersonate the Paybis cryptocurrency exchange platform. The page title, 'Paybis Login | Sign in,' directly mimics the legitimate authentication interface, targeting users attempting to access their accounts. As of the latest assessment, the domain has been taken offline, though prior activity remains under investigation. Analysis indicates the domain was flagged by 5 of 95 security vendors on VirusTotal, reflecting an elevated risk profile. Infrastructure analysis reveals the domain was registered through MarkMonitor, Inc. on May 8, 2013, and resolved to the IP address 104.18.36.248. The SSL certificate is issued by Google Trust Services, which may lend superficial legitimacy to the site. The domain appears on three distinct security blocklists, including entries from browser-based and cryptocurrency-specific threat detection systems. Despite its long registration history, the domain exhibited characteristics consistent with phishing infrastructure, including the use of a content delivery network to obscure hosting origins. Current status confirms the domain is offline, though residual risk remains for users who may have interacted with the site prior to takedown. Organizations and individuals are advised to monitor authentication logs for unauthorized access attempts linked to this domain. Users who entered credentials on this site should immediately rotate passwords and enable multi-factor authentication on all associated accounts. Network administrators are recommended to block the IP address 104.18.36.248 and review proxy logs for connections to sso-paybiss.webflow.io. Continuous monitoring of phishing trends impersonating cryptocurrency platforms is strongly advised, given the persistent targeting of this sector.