paybis-logiin-io-us[.]pages[.]dev

This domain carries a high risk level and is confirmed to be a generic phishing site, specifically designed to steal cryptocurrency login credentials by impersonating the Paybis platform. PhishDestroy identifies this as a fake login page that attempts to trick users into entering their wallet details, effectively acting as a crypto drainer. The site is currently active and poses an immediate threat to anyone who encounters it.

The domain paybis-logiin-io-us.pages.dev was registered through Cloudflare, Inc. on November 10, 2025, and resolves to IP address 188.114.97.3. It uses an SSL certificate issued by Google Trust Services (WE1), which gives it a false sense of security. According to VirusTotal, 2 out of 95 security vendors flag this domain as malicious, and it appears on 3 security blocklists. The page title, "Paybis Login — Anleitung, Tipps & Fehlerbehebung," is in German, indicating the attack may target German-speaking users. These technical indicators, combined with its recent creation and active status, strongly confirm its fraudulent nature.

Users who encounter this domain should immediately close the page and avoid entering any personal or financial information. To protect against such phishing attempts, always verify the official Paybis website URL by typing it directly into the browser or using a trusted bookmark. Enable two-factor authentication on your crypto accounts and consider using a password manager that detects fake sites. If you have already entered credentials, change your passwords immediately and contact Paybis support. Report the domain to cybersecurity authorities and use PhishDestroy to block similar threats in the future.