Klarna

Payments & fintech Swedenklarna.comRank 342 of the most impersonated
Cert findings · 24 h
0
Cert findings · 7 days
6
2 reported or listed · 3 on phishing hosts · 1 on Spamhaus DROP
Registered lookalikes
44
4 listed by a source or an address list
Official domains
46
verified from Klarna's own sites and records

Certificate findings for Klarna

Updated hourly · 2026-11-05 10:53 UTC

DomainSpoof matched these hostnames, from public certificate logs, to Klarna's name or to lookalike spellings of its official domains. Each was reported or listed by one of our sources, or resolved to an address on Spamhaus DROP or DomainSpoof's phishing-host list.

Published now · 7 findings, grouped by hostname

  1. klarna-it.online SK · AS51013 · WEBSUPPORT-SRO-SK-AS WebSup…
    Phishing hostAddress hosted confirmed phishing in the last 48 hMX presentSPF -allDMARC quarantineRegistered 6 mo ago
    DetailsHide
    Hostname
    klarna-it.online
    First seen
    2026-11-01 05:21 UTC
    First published
    2026-11-01 05:51 UTC
    DNS
    Resolves · checked 2026-11-05 05:57 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 37.9.175.196.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 37.9.175.196
    4. Latest DNS check
    Certificate
    Issued by YR1
    Valid 2026-11-01 04:17 UTC to 2027-01-30 04:17 UTC
    Logged 2026-11-01 05:16 UTC in Google ParcelYard2027h1, entry 550,679,733
    SHA-256 2921e429889280ff86605bee609103ed261ea6decd00100f595b73a1e0e2af8d
    Public key SHA-256 514dab1bb6ac0b026d9391e8216db1fda1593736d957d1b0fac7998e6bbb7592
    Brand
    Klarna
    Addresses
    37.9.175.196 · Slovakia · AS51013 WEBSUPPORT-SRO-SK-AS WebSupport s.r.o.
    Domain
    klarna-it.online
    Registered
    2026-05-06 · Gransy, s.r.o.
    MX
    Receives mail at mx10.websupport.sk, mx20.websupport.sk
    SPF
    SPF record with -all: other senders fail
    DMARC
    DMARC policy p=quarantine
    Checked
    2026-11-05 08:41 UTC

    Suggest a correction

  2. klarna-psd3.de SC · AS213373 · IPCONNECT IP Connect Inc
    Spamhaus DROPAddress listed by Spamhaus DROPMX absentSPF missingDMARC missing
    DetailsHide
    Hostname
    klarna-psd3.de
    First seen
    2026-10-31 07:57 UTC
    First published
    2026-10-31 08:21 UTC
    DNS
    Resolves · checked 2026-11-05 08:32 UTC
    Spamhaus DROP
    A brand lookalike resolving to an address on the Spamhaus Don’t Route Or Peer list. Address 45.141.58.188.
    1. Spamhaus DROP list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 45.141.58.188
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-10-31 06:54 UTC to 2027-01-29 07:51 UTC
    Logged 2026-10-31 07:54 UTC in IPng Networks Gouda2027h1, entry 276,545,726
    SHA-256 d07f1769f7917ea39ad87b59b686146d69ab66623ec165de28094842b755b9af
    Public key SHA-256 6e154494466c964792a7c827885cff2fbb7d5b345e20fed9dffb0cc1eed5884a
    Brand
    Klarna
    Addresses
    45.141.58.188 · Seychelles · AS213373 IPCONNECT IP Connect Inc
    Domain
    klarna-psd3.de
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 10:04 UTC

    Suggest a correction

  3. www.klarna-it.aadhyaskin.com US · AS31898 · Oracle Corporation
    ReportedPhishing hostOracle CloudUnder aadhyaskin.com, reported by PhishDestroy · Address hosted confirmed phishing in the last 48 hMX presentSPF ~allDMARC quarantineRegistered 2 y ago
    DetailsHide
    Hostname
    www.klarna-it.aadhyaskin.com
    First seen
    2026-10-31 05:47 UTC
    First published
    2026-10-31 06:08 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Resolves · checked 2026-11-05 06:11 UTC
    Reported
    PhishDestroy, listing aadhyaskin.com and the names under it
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 162.214.80.161.
    1. Phishing-host list fetched with the address
    2. Resolved to 162.214.80.161
    3. Latest DNS check
    Certificate
    Issued by YR2 · precertificate
    Valid 2026-10-31 04:47 UTC to 2027-01-29 04:47 UTC
    Logged 2026-10-31 05:45 UTC in Let's Encrypt Sycamore2027h1, entry 866,870,903
    SHA-256 5563574f107c1fc21be01a2f4aee0c8389507e3447704039e0c525365212554d
    Public key SHA-256 577c2331416cf7111c3c18b27b31bce02a4148948ed5c9702324d7af576275cc
    PhishDestroy
    Brand
    Klarna
    Addresses
    162.214.80.161 · United States · AS31898 ORACLE-BMC-31898 - Oracle Corporation · Oracle Cloud (cloud provider)
    Oracle Cloud
    Oracle Cloud (162.214.80.161): a cloud provider. It rents servers and addresses to its customers.
    Domain
    aadhyaskin.com
    Registered
    2024-07-30 · Bluehost Inc.
    MX
    Receives mail at mail.aadhyaskin.com, aadhyaskin.com
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    DMARC policy p=quarantine
    Checked
    2026-11-05 08:54 UTC

    Suggest a correction

  4. klarna-it.aadhyaskin.com US · AS31898 · Oracle Corporation
    ReportedPhishing hostOracle CloudUnder aadhyaskin.com, reported by PhishDestroy · Address hosted confirmed phishing in the last 48 hMX presentSPF ~allDMARC quarantineRegistered 2 y ago
    DetailsHide
    Hostname
    klarna-it.aadhyaskin.com
    First seen
    2026-10-31 05:47 UTC
    First published
    2026-10-31 06:08 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Resolves · checked 2026-11-05 06:11 UTC
    Reported
    PhishDestroy, listing aadhyaskin.com and the names under it
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 162.214.80.161.
    1. Phishing-host list fetched with the address
    2. Resolved to 162.214.80.161
    3. Latest DNS check
    Certificate
    Issued by YR2 · precertificate
    Valid 2026-10-31 04:47 UTC to 2027-01-29 04:47 UTC
    Logged 2026-10-31 05:45 UTC in Let's Encrypt Sycamore2027h1, entry 866,870,903
    SHA-256 5563574f107c1fc21be01a2f4aee0c8389507e3447704039e0c525365212554d
    Public key SHA-256 577c2331416cf7111c3c18b27b31bce02a4148948ed5c9702324d7af576275cc
    PhishDestroy
    Brand
    Klarna
    Addresses
    162.214.80.161 · United States · AS31898 ORACLE-BMC-31898 - Oracle Corporation · Oracle Cloud (cloud provider)
    Oracle Cloud
    Oracle Cloud (162.214.80.161): a cloud provider. It rents servers and addresses to its customers.
    Domain
    aadhyaskin.com
    Registered
    2024-07-30 · Bluehost Inc.
    MX
    Receives mail at mail.aadhyaskin.com, aadhyaskin.com
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    DMARC policy p=quarantine
    Checked
    2026-11-05 08:54 UTC

    Suggest a correction

  5. polymarket-klarna.co.uk US · AS13335 · Cloudflare, Inc.4 addresses
    ListedCloudflareListed by MetaMaskMX absentSPF missingDMARC missingRegistered 7 mo ago
    DetailsHide
    Hostname
    polymarket-klarna.co.uk
    First seen
    2026-10-27 16:46 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Resolves · checked 2026-11-05 09:04 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE2
    Valid 2026-10-27 15:42 UTC to 2027-01-25 15:42 UTC
    Logged 2026-10-27 16:41 UTC in Google PlumbersArms2027h1, entry 475,012,342
    SHA-256 7d18fa6f04e7ca199ec1da0e7bdca8c05156ea69687b3dd10df4c6d13473a5a8
    Public key SHA-256 f73d4262020b930d297040fb8c980f91203ee646c62e51f6278dd981bed20870
    Brands
    Polymarket, Klarna
    Addresses
    104.21.82.72 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.154.129 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    2606:4700:3032::6815:5248
    2606:4700:3036::ac43:9a81
    Cloudflare
    Cloudflare (104.21.82.72, 172.67.154.129): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    polymarket-klarna.co.uk
    Registered
    2026-04-17 · Namecheap, Inc.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 08:32 UTC

    Suggest a correction

How certificate findings are selected

Reported: PhishTank or PhishDestroy reports the hostname as phishing. Listed: CERT Polska, MetaMask, USOM, MODA, NPA 165, JPCERT/CC, the AMF, the FSMA or BaFin lists it, in the source's own category. Phishing host: the name resolves to an address on DomainSpoof's phishing-host list, the addresses that hosted confirmed phishing in the last 48 hours. Spamhaus DROP: it resolves to an address on the Spamhaus DROP list. Same certificate: it shares a certificate with a finding and has listing evidence of its own, a report or listing by a source or its own Spamhaus DROP address.

DomainSpoof reads public certificate logs and the feeds on Sources every hour. A hostname matches Klarna when a label carries the brand's name, by the rules on How it works. A lookalike spelling of an official domain matches too. A hostname with two kinds of finding is one row. Details shows the recorded checks, the source's claim and the check times available. How it works · Sources

More brands in Payments & fintech

All brands →