Phishing detection: paypal-receipt.xyz
PayPal Screenshot
Investigate
Domain
paypal-receipt.xyz0 CT hosts on apex
urlscan
VirusTotal
Whois
IP
95.85.237.47
ipinfo
Greynoise
URL
http://paypal-receipt.xyz
Phishunt analysis Beta
42
high suspicion likely_phishingheuristic risk score · not a probability
Why?
- +5.3 Keyword match
- +4.5 Brand in title
- +4.1 Brand in screenshot
- +4.0 Young domain
- +3.7 Brand in domain label
- +3.4 Shared IP cluster
- +3.0 Site cluster
- +3.0 TweetFeed
- +2.2 Country mismatch
- +1.1 ASN reputation
- +1.1 No CSP header
- +1.1 No HSTS header
- +0.9 Young certificate
- +0.9 No registrar lock
- +0.9 Suspicious TLD
- +0.7 Brand in cert SAN
- +0.6 Final host mismatch
- +0.6 Registrar reputation
- +0.4 Long domain
- +0.1 Hyphens
- +0.1 External scripts
24 signals fired · detector v3.0.0
AI analysis AIBeta
Credential harvesting
Impersonates PayPal on a five-day-old .xyz domain named to mimic a payment receipt notification. Hosted in Germany via MHost LLC, flagged by TweetFeed as malicious, and confirmed with the PayPal brand in both the domain apex and TLS certificate SAN, likely harvesting PayPal credentials.
TweetFeedBrand in domain labelYoung domain
AI-generated from stored detector signals - the AI never visited the site. · 2026-08-22 · confidence 91%
Domain & Network
Whois
Registrar
Global Domain Group LLC
Network
IP
95.85.237.47
Country
Germany
Germany
Hosting
MHost LLC
ASN
AS200823
TLS Cert
YE1
External detection
TweetFeed
CleanGoogle Safe Browsing · OpenPhish · PhishTank · urlscan.io
Campaign
Requests
Resources
Observables
Related websites
Report this phishing
Brand owner
PayPal
Submit to blocklists