pqybis[.]com

The domain pqybis.com has been identified as a brand impersonation phishing site targeting Google. This infrastructure was actively used to deceive users by presenting fraudulent content under the guise of legitimate services. Analysis confirms the domain is currently offline, though it previously hosted pages mimicking Google-related services. Infrastructure analysis reveals the domain was flagged by 3 of 95 security vendors on VirusTotal, indicating moderate detection coverage. It was registered through Danesco Trading Ltd. on January 27, 2021, and resolved to the IP address 172.66.129.16. The domain appears on one security blocklist, and its Gridinsoft trust score is 0 out of 100. The SSL certificate was issued by Let's Encrypt, a common tactic to lend superficial legitimacy to malicious sites. The page title, 'Buy Bitcoin with Credit Card or Debit Card Instantly | Paybis,' suggests an attempt to impersonate cryptocurrency services, further diverging from the claimed Google impersonation. As of the latest assessment, pqybis.com has been taken offline. Organizations and users are advised to treat any prior interactions with this domain as compromised. Network administrators should ensure the domain and its associated IP address are blocked at the perimeter. Security teams are recommended to review logs for connections to 172.66.129.16 or the domain itself, particularly during the period of its active status. Users who may have engaged with this site should monitor for unauthorized account activity and consider credential resets for any services accessed during the exposure window.