paybiis-us[.]webflow[.]io

This domain is flagged for cryptocurrency phishing, a threat type targeting digital wallet credentials and transaction authorization details. Analysis indicates an elevated risk level due to confirmed malicious activity and infrastructure patterns associated with credential harvesting schemes. Infrastructure analysis reveals the domain paybiis-us.webflow.io was registered through MarkMonitor, Inc. on May 08, 2013, though recent activity suggests repurposing for fraudulent operations. It resolves to the IP address 104.18.36.248, a shared hosting environment, and uses an SSL certificate issued by Google Trust Services. Security vendors flagged this domain in 2 out of 95 detection engines on VirusTotal, while it appears on three independent security blocklists. The site was previously blocked by cryptocurrency security platforms and browser-based threat detection systems. Mitigation requires immediate action from users who may have interacted with this domain. Those who entered wallet credentials or private keys should transfer assets to a new secure wallet and revoke any connected smart contract approvals. Network administrators should block the domain and its resolving IP at the perimeter, while endpoint protection systems should be updated to include this indicator of compromise. Cryptocurrency users are advised to verify all transaction requests through official channels and enable multi-factor authentication on all wallet services.