paybis-refunds[.]com

This domain, paybis-refunds.com, is actively targeting users with a fraudulent crypto asset recovery scheme. The site mimics legitimate cryptocurrency refund services to deceive victims into entering sensitive credentials, including wallet private keys, recovery phrases, or personal identification details. Once obtained, these credentials are used to drain digital assets from compromised accounts. The threat is particularly insidious due to its exploitation of users seeking legitimate refunds or asset recovery, making it appear credible to unsuspecting individuals. Analysis indicates the domain was registered on January 31, 2026, through NAMECHEAP INC, a registrar frequently abused for malicious infrastructure. It resolves to the IP address 162.254.39.231, hosted within AS22612 (Namecheap, Inc.), a network segment with a history of hosting phishing campaigns. Detection metrics further confirm its malicious nature: the domain is flagged by 3 security blocklists, including PhishDestroy, MetaMask, and SEAL, while VirusTotal reports 3 out of 95 security vendors identifying it as malicious. The SSL certificate, issued by Sectigo Limited, provides minimal assurance, as Domain Validation (DV) certificates are routinely exploited in phishing operations to lend a false sense of legitimacy. Users who have interacted with paybis-refunds.com should take immediate action to mitigate potential damage. First, revoke any permissions granted to the site via wallet or exchange interfaces. Next, transfer all digital assets to a new, secure wallet and generate fresh recovery phrases. Monitor linked accounts for unauthorized transactions and enable multi-factor authentication where available. If credentials were entered, assume they are compromised and avoid reusing them across other platforms. Report the domain to relevant security teams and consider filing a complaint with the registrar, NAMECHEAP INC, to aid in takedown efforts. Proactive measures, such as browser-based phishing filters and wallet security extensions, can reduce exposure to similar threats.