Phishing detection: paypal-check.com
PayPal Screenshot
Investigate
Domain
paypal-check.com0 CT hosts on apex
urlscan
VirusTotal
Whois
IP
95.85.237.47
ipinfo
Greynoise
URL
http://paypal-check.com
Phishunt analysis Beta
40
high suspicion likely_phishingheuristic risk score · not a probability
Why?
- +5.3 Keyword match
- +4.5 Brand in title
- +4.1 Brand in screenshot
- +3.7 Brand in domain label
- +3.4 Shared IP cluster
- +3.2 Young domain
- +3.0 Site cluster
- +3.0 TweetFeed
- +2.2 Country mismatch
- +1.1 ASN reputation
- +1.1 No CSP header
- +1.1 No HSTS header
- +0.9 No registrar lock
- +0.7 Brand in cert SAN
- +0.7 Bulletproof DNS
- +0.6 Final host mismatch
- +0.6 Registrar reputation
- +0.5 Young certificate
- +0.3 Long domain
- +0.2 Suspicious TLD
- +0.1 Hyphens
- +0.1 External scripts
25 signals fired · detector v3.0.0
AI analysis AIBeta
Credential harvesting
Site impersonates PayPal with a check or account-verification theme, likely to harvest credentials. It is hosted in Germany on MHost LLC infrastructure, shares an IP with other PayPal spoof domains, the certificate includes the PayPal brand name, and TweetFeed flagged it as malicious.
TweetFeedBrand in cert SANCountry mismatch
AI-generated from stored detector signals - the AI never visited the site. · 2026-08-22 · confidence 88%
Domain & Network
Whois
Registrar
Fewmoretaps OU d/b/a Trustname.com
Network
IP
95.85.237.47
Country
Germany
Germany
Hosting
MHost LLC
ASN
AS200823
TLS Cert
YE1
External detection
TweetFeed
CleanGoogle Safe Browsing · OpenPhish · PhishTank · urlscan.io
Campaign
Requests
Resources
Observables
Related websites
Report this phishing
Brand owner
PayPal
Submit to blocklists