auth-paybislogin-io-us[.]pages[.]dev

The domain auth-paybislogin-io-us.pages.dev is identified as a potential threat for credential phishing. The domain mimics the login page of Paybis, a cryptocurrency exchange platform, which indicates an attempt to deceive users into revealing sensitive information such as usernames and passwords. No specific drainer kit has been identified, but the domain's structure and content suggest it is part of a targeted phishing campaign.

Infrastructure analysis reveals that the domain has a VirusTotal detection score of 1/95, indicating a low level of detection among security vendors. The domain is registered through Cloudflare, Inc., and resolves to the IP address 172.66.44.92. It was created on November 08, 2025, and currently appears on three security blocklists. The SSL certificate is issued by Google Trust Services / WE1, which may lend a false sense of security to unsuspecting users. The Google Safe Browsing (GSB) status is not explicitly mentioned, but the presence on blocklists suggests it is flagged as malicious.

The domain is currently offline, which may indicate that it has been taken down or is no longer actively being used for phishing activities. However, the infrastructure and domain registration details suggest that the threat actors may have the capability to reactivate or deploy similar domains. Users are advised to avoid interacting with this domain or any similar-looking URLs and to report any suspicious activity to their security teams or service providers. The remaining risk is elevated due to the potential for the domain to be reactivated and the low detection rate among security vendors.