paybis[.]co[.]com

Analysis indicates paybis.co.com is a brand impersonation infrastructure targeting Bitcoin-related services, presenting itself as a legitimate cryptocurrency purchase portal. The domain mimics the Paybis branding and is structured to mislead users into trusting payment or credential entry flows. Such impersonation domains typically aim to harvest credit card details, wallet credentials, or redirect users to fraudulent checkout interfaces. Current status is reported as offline, suggesting takedown or sinkholing after detection.

Evidence shows multiple independent security signals. VirusTotal reports 11/95 security vendors flagging the domain. It is listed on 3 security blocklists including MetaMask, PhishDestroy, and SEAL. Gridinsoft assigns a trust score of 0/100, indicating extreme risk classification. The infrastructure resolves to IP 104.21.34.110 and uses Cloudflare with HTTP/3 and Vue.js components. Registrar and creation date are not available in the provided intelligence set, limiting attribution of ownership and timeline.

If a user interacted with this domain, immediate risk mitigation is required. Users should assume potential exposure of financial credentials or wallet seed phrases. Recommended actions include revoking any connected sessions or approvals, changing passwords for any reused credentials, enabling multi-factor authentication, and monitoring cryptocurrency wallets for unauthorized transactions. A full system malware scan is advised if any downloads or scripts were executed. Users should also report the domain to relevant security blocklists and monitor accounts for phishing follow-up attempts.