home-pay-bis-com[.]pages[.]dev

Analysis indicates that home-pay-bis-com.pages.dev was associated with a generic_phishing threat classification. The observed page title, "Ist der Paybis.com Login der schnellste Weg zu Kryptowährungen?", suggests impersonation of a recognizable cryptocurrency-related brand to attract user interaction and credential submission. No drainer kit attribution or payload family could be confirmed from the available evidence. The infrastructure characteristics and blocking activity are consistent with phishing operations that rely on deceptive branding, transient hosting, and rapid deployment cycles.

Technical review identified several notable indicators. The domain home-pay-bis-com.pages.dev was registered on November 10, 2025 through Cloudflare, Inc. and resolved to IPv6 address 2606:4700:310c::ac42:2f09. The site presented an SSL certificate issued by Google Trust Services and utilized technologies including HSTS, Cloudflare services, and HTTP/3. Detection telemetry showed a VirusTotal score of 2/95 security vendors flagging the domain. Independent reputation assessment assigned a trust score of 0/100. The domain appeared on 3 security blocklists and had been blocked by multiple defensive intelligence providers. No evidence was available indicating inclusion on Google Safe Browsing, therefore GSB status could not be confirmed from the supplied dataset.

At the time of analysis, the domain status was offline and the infrastructure had been taken offline, reducing the immediate exposure risk. Despite the takedown, residual risk remains because phishing operators frequently reuse themes, registration patterns, and hosting environments across successive campaigns. Recommended response actions include retaining indicators for historical correlation, monitoring for newly registered lookalike domains, maintaining blocklist coverage for associated infrastructure, and reviewing logs for prior user interactions with the domain. The combination of a recent registration date, 0/100 trust assessment, 3 blocklist appearances, and multiple security detections supports an elevated risk classification even though the resource is no longer active.