PayPal

Payments & fintech United Statespaypal.comRank 6 of the most impersonated
Cert findings · 24 h
1
Cert findings · 7 days
12
2 reported or listed · 8 on phishing hosts · 2 on Spamhaus DROP
Registered lookalikes
128
13 listed by a source or an address list
Official domains
141
verified from PayPal's own sites and records

Certificate findings for PayPal

Updated hourly · 2026-11-05 10:53 UTC

DomainSpoof matched these hostnames, from public certificate logs, to PayPal's name or to lookalike spellings of its official domains. Each was reported or listed by one of our sources, or resolved to an address on Spamhaus DROP or DomainSpoof's phishing-host list.

Published now · 21 findings, grouped by hostname

  1. wwwpaypal.com NL · AS60781 · LEASEWEB-NL-AMS-01 LeaseWeb…2 addresses
    Phishing hostAddress hosted confirmed phishing in the last 48 hMX presentSPF -allDMARC missingRegistered 25 y ago
    DetailsHide
    Hostname
    wwwpaypal.com
    First seen
    2026-11-05 09:05 UTC
    DNS
    Resolves · checked 2026-11-05 09:05 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 212.7.194.71.
    1. Phishing-host list fetched with the address
    2. Resolved to 212.7.194.71
    Brand
    PayPal
    Addresses
    212.7.194.71 · Netherlands · AS60781 LEASEWEB-NL-AMS-01 LeaseWeb Netherlands B.V.
    69.162.80.60 · United States · AS46475 LIMESTONENETWORKS - Limestone Networks, Inc.
    Domain
    wwwpaypal.com
    Registered
    2001-11-19 · Media Elite Holdings Limited, S.A.
    MX
    Receives mail at mail.h-email.net
    SPF
    SPF record with -all: other senders fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 08:41 UTC

    Suggest a correction

  2. www.paypal-acesso.com DE · AS3320 · DTAG Deutsche Telekom AG
    Phishing hostAddress hosted confirmed phishing in the last 48 hMX presentSPF ~allDMARC missingRegistered 8 y ago
    DetailsHide
    Hostname
    www.paypal-acesso.com
    First seen
    2026-11-04 01:52 UTC
    First published
    2026-11-04 03:04 UTC
    DNS
    Resolves · checked 2026-11-05 03:17 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 80.150.6.143.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 80.150.6.143
    4. Latest DNS check
    Certificate
    Issued by YE2
    Valid 2026-11-04 00:51 UTC to 2027-02-02 00:51 UTC
    Logged 2026-11-04 01:49 UTC in Google PlumbersArms2027h1, entry 600,799,186
    SHA-256 0094045355de7689c8114d61f9f77790670a97822781659d33bb36de895cac02
    Public key SHA-256 4d10973d3716284c7045d5c97370490ba4ed0b08fce985be3fc9622c26971c8f
    Brand
    PayPal
    Addresses
    80.150.6.143 · Germany · AS3320 DTAG Deutsche Telekom AG
    Domain
    paypal-acesso.com
    Registered
    2018-06-23 · Deutsche Telekom AG
    MX
    Receives mail at smtp-01.tld.t-online.de, smtp-02.tld.t-online.de
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 03:07 UTC

    Suggest a correction

  3. paypal-acesso.com DE · AS3320 · DTAG Deutsche Telekom AG
    Phishing hostAddress hosted confirmed phishing in the last 48 hMX presentSPF ~allDMARC missingRegistered 8 y ago
    DetailsHide
    Hostname
    paypal-acesso.com
    First seen
    2026-11-04 01:52 UTC
    First published
    2026-11-04 03:04 UTC
    DNS
    Resolves · checked 2026-11-05 03:17 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 80.150.6.143.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 80.150.6.143
    4. Latest DNS check
    Certificate
    Issued by YE2
    Valid 2026-11-04 00:51 UTC to 2027-02-02 00:51 UTC
    Logged 2026-11-04 01:49 UTC in Google PlumbersArms2027h1, entry 600,799,186
    SHA-256 0094045355de7689c8114d61f9f77790670a97822781659d33bb36de895cac02
    Public key SHA-256 4d10973d3716284c7045d5c97370490ba4ed0b08fce985be3fc9622c26971c8f
    Brand
    PayPal
    Addresses
    80.150.6.143 · Germany · AS3320 DTAG Deutsche Telekom AG
    Domain
    paypal-acesso.com
    Registered
    2018-06-23 · Deutsche Telekom AG
    MX
    Receives mail at smtp-01.tld.t-online.de, smtp-02.tld.t-online.de
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 03:07 UTC

    Suggest a correction

  4. www.paypal-casino.se MD · AS200019 · AlexHost ALEXHOST S.R.L.
    Phishing hostAddress hosted confirmed phishing in the last 48 hMX absentSPF missingDMARC missing
    DetailsHide
    Hostname
    www.paypal-casino.se
    First seen
    2026-11-03 18:01 UTC
    First published
    2026-11-03 18:16 UTC
    DNS
    Resolves · checked 2026-11-04 18:20 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 176.123.0.199.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 176.123.0.199
    4. Latest DNS check
    Certificate
    Issued by YR2
    Valid 2026-11-03 16:59 UTC to 2027-02-01 16:59 UTC
    Logged 2026-11-03 17:57 UTC in Google PlumbersArms2027h1, entry 594,915,127
    SHA-256 bd027464b3f9dc314233748808dd60d55491accf9be467b56eafa98252d2863a
    Public key SHA-256 dab1ad3ebe7feefcb10d74b0245f49f14cea05dae58c125882366cd21c786f7d
    Brand
    PayPal
    Addresses
    176.123.0.199 · Moldova · AS200019 AlexHost ALEXHOST S.R.L.
    Domain
    paypal-casino.se
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-04 18:19 UTC

    Suggest a correction

  5. paypal-casino.se MD · AS200019 · AlexHost ALEXHOST S.R.L.
    Phishing hostAddress hosted confirmed phishing in the last 48 hMX absentSPF missingDMARC missing
    DetailsHide
    Hostname
    paypal-casino.se
    First seen
    2026-11-03 18:01 UTC
    First published
    2026-11-03 18:16 UTC
    DNS
    Resolves · checked 2026-11-04 18:20 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 176.123.0.199.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 176.123.0.199
    4. Latest DNS check
    Certificate
    Issued by YR2
    Valid 2026-11-03 16:59 UTC to 2027-02-01 16:59 UTC
    Logged 2026-11-03 17:57 UTC in Google PlumbersArms2027h1, entry 594,915,127
    SHA-256 bd027464b3f9dc314233748808dd60d55491accf9be467b56eafa98252d2863a
    Public key SHA-256 dab1ad3ebe7feefcb10d74b0245f49f14cea05dae58c125882366cd21c786f7d
    Brand
    PayPal
    Addresses
    176.123.0.199 · Moldova · AS200019 AlexHost ALEXHOST S.R.L.
    Domain
    paypal-casino.se
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-04 18:19 UTC

    Suggest a correction

  6. paylink-paypal.com US · AS16509 · Amazon.com, Inc.2 addresses
    ReportedAmazon Web ServicesReported by PhishDestroyMX absentSPF missingDMARC missingRegistered 5 mo ago
    DetailsHide
    Hostname
    paylink-paypal.com
    First seen
    2026-11-03 03:21 UTC
    First published
    2026-11-03 03:45 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Resolves · checked 2026-11-05 03:56 UTC
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR1 · precertificate
    Valid 2026-11-03 02:20 UTC to 2027-02-01 02:20 UTC
    Logged 2026-11-03 03:19 UTC in IPng Networks Gouda2027h1, entry 298,639,886
    SHA-256 34c79179e93b26834113b32c9fb304ea68d89d7fb88d8481d6ef9ae19b528d85
    Public key SHA-256 4cc6f6d1c65d24bf8181c6e6f1e1c2a81ba29cd3c326afb311e3cb8cef27fa37
    PhishDestroy
    Brand
    PayPal
    Addresses
    64.29.17.1 · United States · AS16509 AMAZON-02 - Amazon.com, Inc. · Amazon Web Services (cloud provider)
    216.198.79.1 · United States · AS16509 AMAZON-02 - Amazon.com, Inc. · Amazon Web Services (cloud provider)
    Amazon Web Services
    Amazon Web Services (64.29.17.1, 216.198.79.1): a cloud provider. It rents servers and addresses to its customers.
    Domain
    paylink-paypal.com
    Registered
    2026-06-22 · Name.com, Inc.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 03:53 UTC

    Suggest a correction

  7. www.svitava24.cz CZ · AS25512 · CDT-AS CD-Telematika a.s.
    ReportedReported by PhishTank as imitating PayPalMX absentSPF missingDMARC missingRegistered 7 y ago
    DetailsHide
    Hostname
    www.svitava24.cz
    First seen
    2026-11-02 22:10 UTC
    First published
    2026-11-02 22:16 UTC
    Listing
    PhishTank: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-05 09:46 UTC
    DNS
    Resolves · checked 2026-11-04 22:20 UTC
    Reported
    PhishTank
    1. Observed in the PhishTank feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR2 · precertificate
    Valid 2026-11-02 21:09 UTC to 2027-01-31 21:09 UTC
    Logged 2026-11-02 22:08 UTC in IPng Networks Gouda2027h1, entry 296,837,926
    SHA-256 bb2d88a3566d9bd3919c4e4add51373ab968369049c902bbf853668e85928857
    Public key SHA-256 e4802c91e62f12db426dbf8a9073c1407d9e57f29bcd3eaf10157048e4d17e64
    PhishTank
    PhishTank report #8388873
    Brand
    PayPal
    Addresses
    82.117.143.29 · Czechia · AS25512 CDT-AS CD-Telematika a.s.
    Domain
    svitava24.cz
    Registered
    2019-11-22 · THINline s.r.o. (Český hosting)
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-04 22:18 UTC

    Suggest a correction

  8. webmail.casino-paypal.ca MY · AS45839 · Shinjiru Technology Sdn Bhd
    Spamhaus DROPAddress listed by Spamhaus DROPMX presentMX on Spamhaus DROPSPF ~allSPF on Spamhaus DROPDMARC policy noneRegistered 9 mo ago
    DetailsHide
    Hostname
    webmail.casino-paypal.ca
    First seen
    2026-11-01 21:37 UTC
    First published
    2026-11-01 22:48 UTC
    DNS
    Resolves · checked 2026-11-04 22:56 UTC
    Spamhaus DROP
    A brand lookalike resolving to an address on the Spamhaus Don’t Route Or Peer list. Address 111.90.156.159.
    1. Spamhaus DROP list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 111.90.156.159
    4. Latest DNS check
    Certificate
    Issued by YR1
    Valid 2026-11-01 20:33 UTC to 2027-01-30 20:33 UTC
    Logged 2026-11-01 21:32 UTC in Google ParcelYard2027h1, entry 561,385,393
    SHA-256 398c240e20622877f928a3634f9bdfea9d12fc908813f03c20095de7af7095f2
    Public key SHA-256 f2ad31564838fc48fe629fc1c1f9629d2b0c7738ee4d7a6cf8c664bfee956bb8
    Brand
    PayPal
    Addresses
    111.90.156.159 · Malaysia · AS45839 SHINJIRU-MY-AS-AP - Shinjiru Technology Sdn Bhd
    Domain
    casino-paypal.ca
    Registered
    2026-01-31 · CENTRALNIC CANADA INC
    MX
    Receives mail at _dc-mx.412af7cfffa8.casino-paypal.ca
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    DMARC policy p=none: reports only
    MX listing
    Mail server _dc-mx.412af7cfffa8.casino-paypal.ca at 111.90.156.159 is on Spamhaus DROP: hijacked or criminal networks.
    SPF listing
    The SPF record lists 111.90.156.120 as a sender. It is on Spamhaus DROP: hijacked or criminal networks.
    Checked
    2026-11-04 23:22 UTC

    Suggest a correction

  9. www.us-paypal.com SG · AS63949 · Akamai Connected Cloud3 addresses
    Phishing hostAkamai LinodeAddress hosted confirmed phishing in the last 48 hMX absentSPF missingDMARC missingRegistered 5 mo ago
    DetailsHide
    Hostname
    www.us-paypal.com
    First seen
    2026-10-31 09:52 UTC
    First published
    2026-10-31 10:16 UTC
    DNS
    Resolves · checked 2026-11-05 10:24 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 172.232.24.161.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 172.232.24.161
    4. Latest DNS check
    Certificate
    Issued by YE2
    Valid 2026-10-31 08:48 UTC to 2027-01-29 08:48 UTC
    Logged 2026-10-31 09:47 UTC in Google PlumbersArms2027h1, entry 537,485,274
    SHA-256 2413a1e04f100da41a4092b5a4d1a787799871f0a1cabef006f6063d6736acc8
    Public key SHA-256 9c0d3cae4928bd8bad20b19f0040371e902bb6f7825ecdd301bfef5b7e864f57
    Brand
    PayPal
    Addresses
    172.232.24.161 · Singapore · AS63949 AKAMAI-LINODE-AP - Akamai Connected Cloud · Akamai Linode (cloud provider)
    172.232.24.235 · Singapore · AS63949 AKAMAI-LINODE-AP - Akamai Connected Cloud · Akamai Linode (cloud provider)
    172.234.25.42 · Singapore · AS63949 AKAMAI-LINODE-AP - Akamai Connected Cloud · Akamai Linode (cloud provider)
    Akamai Linode
    Akamai Linode (172.232.24.161, 172.232.24.235, 172.234.25.42): a cloud provider. It rents servers and addresses to its customers.
    Domain
    us-paypal.com
    Registered
    2026-06-17 · NameSilo, LLC
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-04 13:27 UTC

    Suggest a correction

  10. iptvadult-paypal.com SG · AS63949 · Akamai Connected Cloud3 addresses
    Phishing hostAkamai LinodeAddress hosted confirmed phishing in the last 48 hMX presentSPF missingDMARC policy noneRegistered 2 mo ago
    DetailsHide
    Hostname
    iptvadult-paypal.com
    First seen
    2026-10-30 19:52 UTC
    First published
    2026-10-30 20:43 UTC
    DNS
    Resolves · checked 2026-11-04 20:47 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 172.232.24.161.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 172.232.24.161
    4. Latest DNS check
    Certificate
    Issued by YE2 · precertificate
    Valid 2026-10-30 18:48 UTC to 2027-01-28 18:48 UTC
    Logged 2026-10-30 19:46 UTC in DigiCert Wyvern2027h1, entry 362,521,426
    SHA-256 72e89ec2b677444b9de86b48e83725cea894ef3ab12a0b2060a421f6f7ce7177
    Public key SHA-256 9c0d3cae4928bd8bad20b19f0040371e902bb6f7825ecdd301bfef5b7e864f57
    Brand
    PayPal
    Addresses
    172.232.24.161 · Singapore · AS63949 AKAMAI-LINODE-AP - Akamai Connected Cloud · Akamai Linode (cloud provider)
    172.232.24.235 · Singapore · AS63949 AKAMAI-LINODE-AP - Akamai Connected Cloud · Akamai Linode (cloud provider)
    172.234.25.42 · Singapore · AS63949 AKAMAI-LINODE-AP - Akamai Connected Cloud · Akamai Linode (cloud provider)
    Akamai Linode
    Akamai Linode (172.232.24.161, 172.232.24.235, 172.234.25.42): a cloud provider. It rents servers and addresses to its customers.
    Domain
    iptvadult-paypal.com
    Registered
    2026-08-28 · NameSilo, LLC
    MX
    Receives mail at inbound-smtp.us-east-1.amazonaws.com
    SPF
    Publishes no SPF record
    DMARC
    DMARC policy p=none: reports only
    Checked
    2026-11-04 22:18 UTC

    Suggest a correction

  11. mypaypalsecurity.com US · AS6461 · Zayo Bandwidth
    Phishing hostSpamhaus DROPAddress hosted confirmed phishing in the last 48 h · Address listed by Spamhaus DROPMX absentSPF missingDMARC missingRegistered 11 mo ago
    DetailsHide
    Hostname
    mypaypalsecurity.com
    First seen
    2026-10-30 10:42 UTC
    First published
    2026-10-30 10:44 UTC
    DNS
    Resolves · checked 2026-11-05 10:50 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 178.16.54.95.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 178.16.54.95
    4. Latest DNS check
    Spamhaus DROP
    A brand lookalike resolving to an address on the Spamhaus Don’t Route Or Peer list. Address 178.16.54.95.
    1. Spamhaus DROP list fetched with the address
    2. Resolved to 178.16.54.95
    3. Latest DNS check
    Certificate
    Issued by Sectigo Public Server Authentication CA DV E36 · precertificate
    Valid 2026-10-30 00:00 UTC to 2027-01-14 11:38 UTC
    Logged 2026-10-30 10:36 UTC in DigiCert Wyvern2027h1, entry 359,466,869
    SHA-256 b65b259db5d7fd40adcd24edf7f1b55a8ae38392cf2152bb65350b44d290daf7
    Public key SHA-256 adcde5d5c7848b5413a6d0ae9ee75c8e9861ed5d027fbed2a9f83b0ac2dd399e
    Brand
    PayPal
    Addresses
    178.16.54.95 · United States · AS6461 ZAYO-6461 - Zayo Bandwidth
    Domain
    mypaypalsecurity.com
    Registered
    2025-12-20 · OwnRegistrar, Inc.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-04 13:27 UTC

    Suggest a correction

  12. support-paypal-de.com US · AS399979 · 49.3 Networking LLC
    Spamhaus DROPAddress listed by Spamhaus DROPMX absentSPF missingDMARC missingRegistered 8 d ago
    DetailsHide
    Hostname
    support-paypal-de.com
    First seen
    2026-10-28 15:16 UTC
    First published
    2026-10-28 16:14 UTC
    DNS
    Resolves · checked 2026-11-04 16:21 UTC
    Spamhaus DROP
    A brand lookalike resolving to an address on the Spamhaus Don’t Route Or Peer list. Address 104.250.165.186.
    1. Spamhaus DROP list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 104.250.165.186
    4. Latest DNS check
    Certificate
    Issued by YR1 · precertificate
    Valid 2026-10-28 14:14 UTC to 2027-01-26 14:14 UTC
    Logged 2026-10-28 15:13 UTC in DigiCert Sphinx2027h1, entry 295,749,969
    SHA-256 7c0193d8321f5b14e5b82fc8b8b39e1a6b13cd769c26a93db37ab7dd30a8ad97
    Public key SHA-256 81f0328c0ad34aaabe91073f368eef7f6284ecf2ad0fde487e2c4026bff7aaa8
    Brand
    PayPal
    Addresses
    104.250.165.186 · United States · AS399979 AS-493NETWORKING - 49.3 Networking LLC
    Domain
    support-paypal-de.com
    Registered
    2026-10-28 · Cloudflare, Inc.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-04 19:27 UTC

    Suggest a correction

  13. paypal.einloggen-de.com DE · AS210558 · services-1337-gmbh 1337 Ser…
    Spamhaus DROPAddress listed by Spamhaus DROPMX absentSPF missingDMARC missingRegistered 34 d ago
    DetailsHide
    Hostname
    paypal.einloggen-de.com
    First seen
    2026-10-28 11:21 UTC
    First published
    2026-10-28 11:58 UTC
    DNS
    Resolves · checked 2026-11-04 12:09 UTC
    Spamhaus DROP
    A brand lookalike resolving to an address on the Spamhaus Don’t Route Or Peer list. Address 147.90.182.62.
    1. Spamhaus DROP list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 147.90.182.62
    4. Latest DNS check
    Certificate
    Issued by YR1 · precertificate
    Valid 2026-10-28 10:18 UTC to 2027-01-26 10:18 UTC
    Logged 2026-10-28 11:17 UTC in IPng Networks Halloumi2027h1, entry 287,853,225
    SHA-256 412e93e0041748f7e8489c5c261cbba264daa1246f9a2bf7d723ea167e326dea
    Public key SHA-256 2f2b51be3e0cb57a4f7edd0246353991d4a747c330ae78a3d9a89d4d25635605
    Brand
    PayPal
    Addresses
    147.90.182.62 · Germany · AS210558 services-1337-gmbh 1337 Services GmbH
    Domain
    einloggen-de.com
    Registered
    2026-10-02 · Hosting Concepts B.V. d/b/a Registrar.eu
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-04 14:35 UTC

    Suggest a correction

  14. www.paypal.es.adr.com.ua NL · AS60781 · LEASEWEB-NL-AMS-01 LeaseWeb…
    Phishing hostAddress hosted confirmed phishing in the last 48 hMX presentSPF -allDMARC missingRegistered 12 y ago
    DetailsHide
    Hostname
    www.paypal.es.adr.com.ua
    First seen
    2026-10-27 11:26 UTC
    DNS
    Resolves · checked 2026-11-05 09:06 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 5.79.66.145.
    1. Phishing-host list fetched with the address
    2. Resolved to 5.79.66.145
    3. Latest DNS check
    Certificate
    Logged in Google ParcelYard2027h1, entry 470,470,280
    SHA-256 17f55d6b5194cbd2955a6676e0e945eb932d8947753b67ea0305a86139f5773e
    Brand
    PayPal
    Addresses
    5.79.66.145 · Netherlands · AS60781 LEASEWEB-NL-AMS-01 LeaseWeb Netherlands B.V.
    Domain
    adr.com.ua
    Registered
    2015-02-14 · Ukrainian internet names Center LLC
    MX
    Receives mail at mail.zzz.com.ua
    SPF
    SPF record with -all: other senders fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 08:30 UTC

    Suggest a correction

  15. paypal.es.adr.com.ua NL · AS60781 · LEASEWEB-NL-AMS-01 LeaseWeb…
    Phishing hostAddress hosted confirmed phishing in the last 48 hMX presentSPF -allDMARC missingRegistered 12 y ago
    DetailsHide
    Hostname
    paypal.es.adr.com.ua
    First seen
    2026-10-27 11:26 UTC
    DNS
    Resolves · checked 2026-11-05 09:02 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 5.79.66.145.
    1. Phishing-host list fetched with the address
    2. Resolved to 5.79.66.145
    3. Latest DNS check
    Certificate
    Logged in Google ParcelYard2027h1, entry 470,470,280
    SHA-256 17f55d6b5194cbd2955a6676e0e945eb932d8947753b67ea0305a86139f5773e
    Brand
    PayPal
    Addresses
    5.79.66.145 · Netherlands · AS60781 LEASEWEB-NL-AMS-01 LeaseWeb Netherlands B.V.
    Domain
    adr.com.ua
    Registered
    2015-02-14 · Ukrainian internet names Center LLC
    MX
    Receives mail at mail.zzz.com.ua
    SPF
    SPF record with -all: other senders fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 08:30 UTC

    Suggest a correction

  16. paypalcointrade.com US · AS6461 · Zayo Bandwidth
    ListedPhishing hostSpamhaus DROPListed by CERT Polska · Address hosted confirmed phishing in the last 48 h · Address listed by Spamhaus DROPMX presentSPF missingDMARC missingRegistered 4 mo ago
    DetailsHide
    Hostname
    paypalcointrade.com
    First seen
    2026-10-27 06:51 UTC
    Listing
    CERT Polska listed it 2026-08-30 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 09:17 UTC
    DNS
    Resolves · checked 2026-11-05 09:01 UTC
    Listed
    CERT Polska
    1. Listed by CERT Polska
    2. We matched its certificate name
    3. Latest DNS check
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 158.94.210.119.
    1. Phishing-host list fetched with the address
    2. Resolved to 158.94.210.119
    3. Latest DNS check
    Spamhaus DROP
    A brand lookalike resolving to an address on the Spamhaus Don’t Route Or Peer list. Address 158.94.210.119.
    1. Spamhaus DROP list fetched with the address
    2. Resolved to 158.94.210.119
    3. Latest DNS check
    Certificate
    Logged in IPng Networks Gouda2027h1, entry 236,319,487
    SHA-256 1c92163c92b6eb8fe4f77f022e9d9d4227b020720b10245d227140123387bae5
    Brand
    PayPal
    Addresses
    158.94.210.119 · United States · AS6461 ZAYO-6461 - Zayo Bandwidth
    Domain
    paypalcointrade.com
    Registered
    2026-07-16 · Dynadot Inc
    MX
    Receives mail at parkmail.dynadot.com
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 08:28 UTC

    Suggest a correction

  17. invoicepaypal.com SG · AS63949 · Akamai Connected Cloud3 addresses
    Phishing hostAkamai LinodeAddress hosted confirmed phishing in the last 48 hMX absentSPF missingDMARC missingRegistered 4 mo ago
    DetailsHide
    Hostname
    invoicepaypal.com
    First seen
    2026-10-27 06:36 UTC
    DNS
    Resolves · checked 2026-11-05 08:59 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 172.232.24.161.
    1. Phishing-host list fetched with the address
    2. Resolved to 172.232.24.161
    3. Latest DNS check
    Certificate
    Logged in Google ParcelYard2027h1, entry 467,114,041
    SHA-256 46a4bbee32a2eb945b4b94bda5607f04c6382f8c8808bb164dcb2ddf4952afcb
    Brand
    PayPal
    Addresses
    172.232.24.161 · Singapore · AS63949 AKAMAI-LINODE-AP - Akamai Connected Cloud · Akamai Linode (cloud provider)
    172.232.24.235 · Singapore · AS63949 AKAMAI-LINODE-AP - Akamai Connected Cloud · Akamai Linode (cloud provider)
    172.234.25.42 · Singapore · AS63949 AKAMAI-LINODE-AP - Akamai Connected Cloud · Akamai Linode (cloud provider)
    Akamai Linode
    Akamai Linode (172.232.24.161, 172.232.24.235, 172.234.25.42): a cloud provider. It rents servers and addresses to its customers.
    Domain
    invoicepaypal.com
    Registered
    2026-06-25 · NameSilo, LLC
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 08:28 UTC

    Suggest a correction

  18. paypal-payment.com US · AS31898 · Oracle Corporation
    Phishing hostOracle CloudAddress hosted confirmed phishing in the last 48 hMX presentSPF -allDMARC rejectRegistered 11 y ago
    DetailsHide
    Hostname
    paypal-payment.com
    First seen
    2026-10-26 15:27 UTC
    DNS
    Resolves · checked 2026-11-05 09:01 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 64.181.217.59.
    1. Phishing-host list fetched with the address
    2. Resolved to 64.181.217.59
    3. Latest DNS check
    Certificate
    Logged in IPng Networks Gouda2027h1, entry 231,470,023
    SHA-256 954cb444ba5b9d08a3ecad124e523ef1103591e1068cc6b28a0524442bec5c65
    Brand
    PayPal
    Addresses
    64.181.217.59 · United States · AS31898 ORACLE-BMC-31898 - Oracle Corporation · Oracle Cloud (cloud provider)
    Oracle Cloud
    Oracle Cloud (64.181.217.59): a cloud provider. It rents servers and addresses to its customers.
    Domain
    paypal-payment.com
    Registered
    2015-08-18 · Cloudflare, Inc.
    MX
    Receives mail at mail.paypal-payment.com
    SPF
    SPF record with -all: other senders fail
    DMARC
    DMARC policy p=reject
    Checked
    2026-11-05 08:23 UTC

    Suggest a correction

How certificate findings are selected

Reported: PhishTank or PhishDestroy reports the hostname as phishing. Listed: CERT Polska, MetaMask, USOM, MODA, NPA 165, JPCERT/CC, the AMF, the FSMA or BaFin lists it, in the source's own category. Phishing host: the name resolves to an address on DomainSpoof's phishing-host list, the addresses that hosted confirmed phishing in the last 48 hours. Spamhaus DROP: it resolves to an address on the Spamhaus DROP list. Same certificate: it shares a certificate with a finding and has listing evidence of its own, a report or listing by a source or its own Spamhaus DROP address.

DomainSpoof reads public certificate logs and the feeds on Sources every hour. A hostname matches PayPal when a label carries the brand's name, by the rules on How it works. A lookalike spelling of an official domain matches too. A hostname with two kinds of finding is one row. Details shows the recorded checks, the source's claim and the check times available. How it works · Sources

More brands in Payments & fintech

All brands →