Phishing detection: paypal.cardpaysecurity.org

PayPal
http://paypal.cardpaysecurity.org/login/tfkxscsmt_48_qyabrl9ii9hgjwliow24vue=0aq==/kjken0okg_psackvuioa_hbsebtjbuf6 Access site
Screenshot
Screenshot of paypal.cardpaysecurity.org
Investigate
Domain paypal.cardpaysecurity.org1 CT host on apex
urlscan page.domain VirusTotal Whois
IP 3.174.46.121
urlscan page.ip VirusTotal ipinfo Greynoise
URL http://paypal.cardpaysecurity.org/login/tfkxscsmt_48_qyabrl…
urlscan Wayback archive.today
Cert Amazon RSA 2048 M02
crt.sh Censys Google CT
Phishunt analysis Beta
35 medium suspicion suspiciousheuristic risk score · not a probability
Keyword matchBrand in subdomainCredential path
19 signals fired · detector v2.0.0
Domain & Network
Whois
Registrar GoDaddy.com, LLC
Network
IP 3.174.46.121
Country GermanyGermany
Hosting Amazon.com, Inc.
ASN AS16509
TLS Cert Amazon RSA 2048 M02
External detection Google Safe Browsing OpenPhish urlscan.io
GSB category: SOCIAL_ENGINEERING
CleanPhishTank · TweetFeed
Related infrastructure Betasuspected links from shared infrastructure, not attribution
microsoftquarantine.authorised-support.com 44 same redirect target same TLS cert shared TLS SAN same screenshot
active 2026-05-12
spotify.servernotification.events 40 same redirect target same TLS cert shared TLS SAN same screenshot
active 2026-06-20
microsoft.authorised-support.com 30 same redirect target same TLS cert shared TLS SAN
active 2026-05-15
microsoft.account.trustedentity.com 30 same redirect target same screenshot
active 2026-05-13
amazonwebservices.security-unauthorised-request.com 24 same redirect target same TLS cert shared TLS SAN
active 2026-05-06
Top 5 of 5 related · rebuilt daily · corr-1.2.0 · related infrastructure API
Report this phishing
Network / ASN Amazon.com, Inc.
abuse@amazonaws.com Web form
Registrar GoDaddy.com, LLC
abuse@godaddy.com Web form
Brand owner PayPal
phishing@paypal.com Web form
Submit to blocklists
Google Safe Browsing Microsoft SmartScreen APWG PhishTank
Not phishing? Dispute this detection

Tracked from 2026-05-14 13:07 UTC  ·  Last refreshed 2026-07-22 01:30 UTC