Phishing detection: paypal-login-support.com
PayPal Screenshot
Investigate
Domain
paypal-login-support.com2 CT hosts on apex
urlscan
VirusTotal
Whois
IP
209.99.185.33
ipinfo
Greynoise
URL
https://paypal-login-support.com
Phishunt analysis Beta
75
high suspicion likely_phishingheuristic risk score · not a probability
Why?
- +5.3 Keyword match
- +4.5 Brand in title
- +4.0 Young domain
- +3.9 Password field
- +3.7 Brand in domain label
- +2.2 Country mismatch
- +2.0 Site cluster
- +1.4 Registrar reputation
- +1.1 ASN reputation
- +1.1 No CSP header
- +1.1 No HSTS header
- +0.9 Young certificate
- +0.9 No registrar lock
- +0.8 Brand + login token
- +0.7 Brand in cert SAN
- +0.7 Bulletproof DNS
- +0.6 Login text in screenshot
- +0.6 Script exfil endpoint
- +0.5 Long domain
- +0.3 Free CA
- +0.2 Hyphens
- +0.2 Suspicious TLD
- +0.1 External scripts
- Boosted to 75: Credential exfil kit
25 signals fired · detector v3.0.0
AI analysis AIBeta
Credential harvesting
Impersonates PayPal on a two-day-old combosquat domain and presents a live password input form to capture account credentials. Hosted on infrastructure in Switzerland via a Chinese registrar, with missing HSTS and CSP headers and a classifier score double the baseline.
Password fieldBrand + login tokenYoung domain
AI-generated from stored detector signals - the AI never visited the site. · 2026-08-31 · confidence 92%
Domain & Network
Whois
Registrar
NICENIC INTERNATIONAL GROUP CO., LIMITED
Network
Country
Switzerland
Switzerland
Hosting
SKN Subnet & Telecom Ltd
ASN
AS402253
TLS Cert
YR2
External detection
SANS ISC
SANS score: 7 · High entropy: 3.52 (+0.11)|Contains suspicious keyword: login (+20)|Contains suspicious keyword: support (+20)
CleanGoogle Safe Browsing · OpenPhish · PhishTank · TweetFeed · urlscan.io
Requests
Resources
Observables
Related websites
Report this phishing
Brand owner
PayPal
Submit to blocklists