lgin-paybis[.]webflow[.]io

This domain, lgin-paybis.webflow.io, is identified as a credential theft operation specifically targeting users of the cryptocurrency exchange Paybis. Analysis of the page title, "Paybis Login | Sign in," confirms brand impersonation tactics designed to deceive victims into entering login credentials. No direct evidence of a crypto drainer kit was observed, but the domain’s structure and content align with credential harvesting campaigns commonly used as a precursor to account takeover or financial fraud. Infrastructure analysis reveals the following technical indicators: the domain resolves to IP address 104.18.36.248 and is registered through MarkMonitor, Inc., with a creation date of May 08, 2013. The domain is currently flagged by 5 out of 95 security vendors on VirusTotal, appears on 3 security blocklists, and employs an SSL certificate issued by Google Trust Services. The site was hosted behind Cloudflare, utilizing HTTP/3 for communication, which may have been leveraged to obfuscate malicious activity. No Google Safe Browsing (GSB) flags were explicitly noted, but the domain’s presence on multiple blocklists indicates prior detection. As of the latest assessment, lgin-paybis.webflow.io has been taken offline, reducing immediate risk to end users. The domain was blocked by at least three security entities, including browser-based and network-level protections. Despite its offline status, residual risk remains due to potential credential reuse by victims who may have interacted with the site prior to its takedown. Users who entered credentials on this domain are advised to immediately reset passwords on the legitimate Paybis platform and enable multi-factor authentication. Organizations should monitor for signs of account compromise, such as unauthorized transactions or login attempts from unfamiliar locations.