en-paybis[.]pages[.]dev

This domain, en-paybis.pages.dev, has been identified as a credential theft operation specifically targeting users of the cryptocurrency exchange Paybis. The page, currently offline, presented itself as a legitimate login portal with the title 'Paybis Login | Sicherer Zugang zu Ihrer Krypto-Plattform,' designed to harvest user credentials for unauthorized access to crypto wallets and exchange accounts. Analysis indicates this infrastructure was deployed to facilitate account takeovers and subsequent unauthorized transactions, aligning with common tactics used in crypto-focused phishing campaigns. Infrastructure analysis reveals the domain was registered on October 28, 2025, through Cloudflare, Inc., and resolved to the IP address 172.66.44.153. Despite its recent creation, the domain has already been flagged by three security blocklists, including MetaMask, PhishDestroy, and SEAL. The Gridinsoft trust score for this domain is 0 out of 100, reflecting its high-risk nature. Notably, VirusTotal reports 0 detections out of 95 vendors, suggesting the infrastructure may have evaded initial automated detection mechanisms. The SSL certificate is issued by Google Trust Services, which, while legitimate, is commonly exploited by threat actors to lend false credibility to phishing pages. Current status indicates the domain has been taken offline, likely in response to blocklist inclusion or manual takedown efforts. However, the risk of re-emergence under a similar or altered domain remains high. Organizations and individuals are advised to implement the following mitigations: block the domain en-paybis.pages.dev and its associated IP 172.66.44.153 at the network level; monitor for similar domains registered through Cloudflare or resolving to the same IP range; and educate users on recognizing crypto-related phishing attempts, particularly those impersonating Paybis or other exchanges. Security teams should also review logs for any interactions with this domain prior to its takedown and consider resetting credentials for accounts that may have been exposed.