paypal.cardpaysecurity.org

PayPal

http://paypal.cardpaysecurity.org/login/tfkxscsmt_48_qyabrl9ii9hgjwliow24vue=0aq==/kjken0okg_psackvuioa_hbsebtjbuf6 Access site

Screenshot

Investigate

Domain paypal.cardpaysecurity.org1 CT host on apex

urlscan

page.domain

VirusTotal

Whois

IP 3.174.46.121

urlscan

page.ip

VirusTotal

ipinfo

Greynoise

URL http://paypal.cardpaysecurity.org/login/tfkxscsmt_48_qyabrl…

urlscan

Wayback

archive.today

Cert Amazon RSA 2048 M02

crt.sh

Censys

Google CT

Phishunt analysis Beta

35 medium suspicion suspiciousheuristic risk score · not a probability

Keyword matchBrand in subdomainCredential path

19 signals fired · detector v2.0.0

AI analysis AIBeta

Credential harvesting

Site places the PayPal brand in a subdomain of a fraudulent payment security domain and uses obfuscated path tokens encoding victim identifiers. It is flagged by Google Safe Browsing, OpenPhish, and urlscan, and hosted on AWS in Germany targeting PayPal credentials.

Brand in subdomainGoogle Safe BrowsingCredential path

AI-generated from stored detector signals - the AI never visited the site. · 2026-07-23 · confidence 93%

Domain & Network

Whois

Registrar GoDaddy.com, LLC

Network

IP 3.174.46.121

Country