Security Scan: Log in to your PayPal account

Summary

API

This view is built from:

Scan result: counts, verdicts, details, IPs, technologies, hashes/api/v1/result/111a2c3d-6bb8-4df2-acbb-8b67884d9393 Domain and IP registration (RDAP)/api/v1/rdap/111a2c3d-6bb8-4df2-acbb-8b67884d9393How often this domain was scanned/api/v1/domain/stats/pay-pal.netlify.app Scan history for this domain/api/v1/domain/history/pay-pal.netlify.app?limit=15

This website contacted 10 IPs in 3 countries across 8 domains to perform 28 HTTP transactions. The main domain is netlify.app and was registered 8 years ago.

Submitted URL: https://pay-pal.netlify.app/

AI Security Verdict

Confirmed Scam

Confidence: 97%

Risk Score

Confirmed PayPal phishing clone on a free Netlify subdomain: it wears PayPal's favicon and login page and harvests email/password via ./temp.php, matching a Safe Browsing and HIGH IDS phishing alert.

Risk Factors (5)

PayPal brand impersonation on a non-PayPal domain (favicon, title, login copy)

Credential harvesting form (email + password) submitted to a local './temp.php' script instead of PayPal infrastructure

Google Safe Browsing Social Engineering threat detected

IDS HIGH severity PayPal phishing landing alert

Free shared-hosting subdomain with unknown creation date and no domain reputation

Domain age information unavailable

Details

Page Title

Scan Type

public

Favicon Hash

MMH3: 309020573

MD5: e1528b5176081f0ed963ec8397bc8fd3

Domain Name Analysis

You're looking at domain 'pay-pal.netlify.app' on the application-focused generic top-level domain (.app), featuring subdomain 'pay-pal'. Its registrable label 'netlify' stretches across 7 characters holding 2 vowels versus five consonants. Tokenizing the label suggests three words: net, li, fy. Median word length is 2 characters. No strong language cues emerged from the frequency lists.

Screenshot

Page Load Overview

7.12s

Total Load Time

246 KB

Total Size

Language Analysis

Primary Language

🇺🇸English

Code: en

Confidence:80%

Script:Latin

Direction:ltr

Detection Details

HTML Lang Attribute:en

Text Length:1,891 chars

Detector Agreement:100%

Website Classification

Primary Category

e-commerce25% confidence

Type: webapp

Method: ml+structural+ocr_tiebreaker

All Detected Categories

e-commerce

25%

Detected Features

Domain & IP Information

Requests	IP Address	Location	AS Autonomous System
10	63.176.8.218Aws · CLOUD	Frankfurt am Main, Hesse, Germany	AS16509Amazon.com, Inc.
2	104.17.207.24Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
2	104.18.35.171Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
2	146.75.121.21Fastly · CDN	Frankfurt am Main, Hesse, Germany	AS54113Fastly, Inc.
2	192.55.233.1	United States	Unknown
2	34.147.177.40Google · CDN	City of London, England, United Kingdom	AS396982Google LLC
2	35.157.26.135Aws · CLOUD	Frankfurt am Main, Hesse, Germany	AS16509Amazon.com, Inc.
2	104.17.208.24Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
2	172.64.152.85Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
2	146.75.121.35Fastly · CDN	Frankfurt am Main, Hesse, Germany	AS54113Fastly, Inc.
28	10	-	-