paybiis-login[.]pages[.]dev

This domain is flagged as a high-risk credential phishing site specifically targeting cryptocurrency wallet users through a fake Paybis login portal. The threat involves harvesting login credentials, which could lead to unauthorized access and asset theft from connected crypto wallets or exchange accounts. Analysis indicates this is not a generic phishing attempt but a targeted operation mimicking a legitimate cryptocurrency service interface. Infrastructure analysis reveals the domain paybiis-login.pages.dev was registered through Cloudflare on November 03, 2025, and resolves to IP address 188.114.97.3. Security vendor detections on VirusTotal show 14 out of 95 engines flagging the domain, while it appears on three security blocklists. The site employed HSTS and HTTP/3 protocols, with an SSL certificate issued by Google Trust Services. A Gridinsoft trust score of 0/100 further confirms malicious intent, and the page title explicitly mimicked 'Paybis Login - Access Your Secure Crypto Wallet' to deceive users. Mitigation requires immediate domain blocking at network and endpoint levels. Organizations should add the domain to web filtering rules and update security tools to detect the IP address 188.114.97.3. Users who may have interacted with the site should revoke active sessions, reset credentials for any entered accounts, and enable multi-factor authentication where available. Cryptocurrency wallet users should check for unauthorized transactions and consider migrating assets to new wallet addresses if compromise is suspected. Network administrators should monitor for connections to the resolved IP and investigate any related credential submission attempts.