paybis-sso-com-auth[.]webflow[.]io

The domain paybis-sso-com-auth.webflow.io is identified as a generic_phishing site impersonating the legitimate Paybis service. No specific drainer kit has been detected, but the domain's structure and title suggest an intent to deceive users into providing sensitive information.

Infrastructure analysis reveals that paybis-sso-com-auth.webflow.io resolves to the IP address 104.18.36.248. The domain was created on May 08, 2013, and is registered through MarkMonitor, Inc. The domain is protected by an SSL certificate issued by Google Trust Services, and it uses Cloudflare and HTTP/3 technologies. According to VirusTotal, 5 out of 95 security vendors flag this domain as malicious. Additionally, the domain appears on 3 security blocklists, indicating a moderate level of recognition among security communities.

The domain is currently offline, which reduces the immediate risk of user data compromise. However, the presence of the domain on multiple blocklists and the historical flagging by security vendors suggest that it has been actively used for phishing attacks in the past. Organizations and individuals should continue to monitor for any reactivation of the domain and ensure that their security systems are updated to block it. Despite its offline status, any stored data or credentials obtained during its active period may still be at risk, and users should change passwords and monitor their accounts for unauthorized activity.