auth-paybis-login[.]pages[.]dev

This domain, auth-paybis-login.pages.dev, operates as a credential phishing site designed to harvest login credentials under the guise of a legitimate cryptocurrency wallet service. The page title, 'Crypto Wallet - Best Free Crypto Wallet for You,' mimics branding associated with trusted wallet providers, increasing the likelihood of deception. Analysis indicates the site targets users seeking wallet access, prompting them to enter sensitive credentials, which are then exfiltrated to attacker-controlled infrastructure. The threat extends beyond credential theft, as compromised accounts may lead to unauthorized transactions or further exploitation of connected financial services. Infrastructure analysis reveals the domain was registered on October 30, 2025, through Cloudflare, Inc., a registrar frequently leveraged for rapid deployment of phishing infrastructure. The domain resolves to the IP address 188.114.96.3 and employs technologies such as HSTS and HTTP/3, which are often used to enhance perceived legitimacy. Despite these technical measures, detection systems initially failed to identify the threat, as evidenced by a VirusTotal detection score of 0/95 at the time of analysis. However, the domain has since been flagged by three security blocklists, including high-confidence feeds, and has been taken offline. The SSL certificate, issued by Google Trust Services, further obscures malicious intent by providing an appearance of security. Users who visited auth-paybis-login.pages.dev or entered credentials on the site are at high risk of account compromise. Immediate action is required, including revoking any entered credentials, enabling multi-factor authentication on all associated accounts, and monitoring for unauthorized transactions. If cryptocurrency wallet credentials were submitted, users should transfer assets to a new, secure wallet and audit all connected services for signs of compromise. Given the domain's recent creation and low initial detection rates, similar campaigns may still be active; users are advised to verify domain authenticity through official channels before entering sensitive information.