Security Scan: Pay invoice

Summary

API

This view is built from:

Scan result: counts, verdicts, details, IPs, technologies, hashes/api/v1/result/87cace5a-9761-4178-9b72-a1c072a88c4b Domain and IP registration (RDAP)/api/v1/rdap/87cace5a-9761-4178-9b72-a1c072a88c4b Certificate Transparency/api/v1/ct/paypal.com How often this domain was scanned/api/v1/domain/stats/paypal.com Scan history for this domain/api/v1/domain/history/paypal.com?limit=15

This website contacted 29 IPs in 3 countries across 22 domains to perform 136 HTTP transactions. The main domain is paypal.com and was registered 27 years ago.

Submitted URL: https://www.paypal.com/invoice/payerView/details/INV2-GS3K-JFSF-BGTD-V35T?cc-email=true&action=report-spam&v=1&utm_source=unp&utm_medium=email&utm_campaign=RTI003384&utm_unptid=39bd4cfa-c0ca-11f1-8d5c-c749dd465c15&ppid=RTI003384&cnac=AU&rsta=en_AU%28en-AU%29&unptid=39bd4cfa-c0ca-11f1-8d5c-c749dd465c15&calc=d62e7a9b523da&unp_tpcid=invoice-buyer-notification&page=main%3Aemail%3ARTI003384&pgrp=main%3Aemail&e=cl&mchn=em&s=ci&mail=sys&appVersion=1.446.0&tenant_name=&xt=186218%2C182450%2C186220%2C175543%2C104038%2C184933%2C184935%2C180658&xe=115153%2C114833%2C115152%2C114002%2C101255%2C114941%2C115052%2C114543&link_ref=details_inv2-gs3k-jfsf-bgtd-v35t

The Cisco Umbrella rank of the primary domain is #1,990 of the top 1 million websitesTop 10K Site

AI Security Verdict

Low Risk

Confidence: 70%

Risk Score

Genuine paypal.com invoice viewer displaying an attacker-submitted fraudulent invoice ($999.99, 'Outsourcing Holdings') that lures victims to call a tech-support number. Do not call or pay; report the invoice.

Risk Factors (4)

Fraudulent invoice content with a high-pressure $999.99 charge and a callback support number (tech-support fraud lure)

Invoice created by a non-existent/shell entity ('Outsourcing Holdings, Inc.') with no verifiable business identity

Page bears a 'reported as possible scam' warning while still soliciting action/payment

Spelling/date anomalies ('Ammount', issue date Oct 5, 2026) inconsistent with genuine billing documents

Safety Factors (5)

Page is served from the genuine, 27-year-old paypal.com domain (Umbrella rank ~1990, top-10K)

No credential, password or payment input forms on the page (0 forms, 0 password fields, 0 payment fields)

No Indicators of Compromise, JavaScript-YARA malware, IDS alerts or known phishing kits detected

Brand check passed — no impersonation of another entity's brand; page is PayPal's own invoice viewer

Top-ranked domain (Cisco Umbrella #1,990, 9944 days old) with no strong malicious indicators — a login form on a household-name site is normal; risk clamped from 7 to 3

Domain age information unavailable

Details

Page Title

Pay invoice

Scan Type

public

Favicon Hash

MMH3: 309020573

MD5: e1528b5176081f0ed963ec8397bc8fd3

Domain Name Analysis

Within the commercial generic top-level domain (.com), 'www.paypal.com' is registered with subdomain 'www'. The registrable portion 'paypal' spans 6 characters with 2 vowels and four consonants. Word splitting yields 1 word: paypal. No strong language cues emerged from the frequency lists.

Screenshot

Page Load Overview

5.14s

Total Load Time

3.6 MB

Total Size

Language Analysis

Primary Language

🇺🇸English

Code: en

Confidence:50%

Script:Latin

Direction:ltr

Detection Details

HTML Lang Attribute:en_US

Text Length:770 chars

Detector Agreement:100%

Website Classification

Primary Category

finance banking44% confidence

Type: spa

Method: ml+structural

All Detected Categories

finance banking

44%

download file sharing

42%

technology software

40%

government public service

34%

documentation technical

32%

Detected Features

No structural features detected

Domain & IP Information

Requests	IP Address	Location	AS Autonomous System
24	146.75.121.21Fastly · CDN	Frankfurt am Main, Hesse, Germany	AS54113Fastly, Inc.
4	104.17.208.24Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
4	17.253.57.204	Frankfurt am Main, Hesse, Germany	AS6185Apple Inc.
4	192.178.183.97Google · CDN	United States	AS15169Google LLC
4	146.75.123.1Fastly · CDN	Frankfurt am Main, Hesse, Germany	AS54113Fastly, Inc.
4	34.147.177.40Google · CDN	City of London, England, United Kingdom	AS396982Google LLC
4	146.75.121.35Fastly · CDN	Frankfurt am Main, Hesse, Germany	AS54113Fastly, Inc.
4	34.149.66.163Google · CDN	Kansas City, Missouri, United States	AS396982Google LLC
4	3.228.185.195Aws · CLOUD	Ashburn, Virginia, United States	AS14618Amazon.com, Inc.
4	104.17.207.24Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
136	29	-	-