paypal-pay.com - phishunt.io

PayPal

http://www.paypal-pay.com Access site

Screenshot

Investigate

Domain www.paypal-pay.com2 CT hosts on apex

urlscan

page.domain

VirusTotal

Whois

See every phishunt record for this domain

IP 216.198.79.1

urlscan

page.ip

VirusTotal

ipinfo

Greynoise

URL http://www.paypal-pay.com

urlscan

Wayback

archive.today

Cert YR1

crt.sh

Censys

Google CT

Phishunt analysis Beta

45 high suspicion likely_phishingheuristic risk score · not a probability

Why?

+5.3 Keyword match
+5.1 Site cluster
+4.5 Brand in title
+4.1 Brand in screenshot
+4.0 Young domain
+3.7 Brand in domain label
+3.4 Shared IP cluster
+3.2 Brand favicon
+3.0 OpenPhish
+1.6 Favicon (kit)
+1.1 No CSP header
+0.9 Young certificate
+0.9 No registrar lock
+0.8 ASN reputation
+0.7 Brand in cert SAN
+0.7 Brand typo
+0.6 Script exfil endpoint
+0.4 Long domain
+0.3 Free CA
+0.2 Suspicious TLD
+0.1 Hyphens
+0.1 Deep subdomain

27 signals fired · detector v3.0.0

AI analysis AIBeta

Credential harvesting

Site impersonates PayPal using a lookalike domain embedding the brand name. A script exfiltration endpoint is present, indicating active harvesting of submitted credentials or payment data. Hosted on Amazon infrastructure, it clusters with PayPal phishing pages and is flagged by OpenPhish.

Script exfil endpointOpenPhishBrand in domain label

AI-generated from stored detector signals - the AI never visited the site. · 2026-09-10 · confidence 82%

Domain & Network

Whois

Registrar Name.com, Inc.

Network

IP 216.198.79.1

Country