Paypal phishing and impersonation - 2 domains observed

MalwareAnalyzer by Cyble has observed 2 distinct domains impersonating Paypal across 11 URL scans. 2 of them carry a malicious or suspicious verdict, and the pages were built with the kit generic paypal harvester. None of these domains belong to Paypal; they are sites impersonating it, detected by comparing a page's claimed identity against evidence of who actually operates it.

Paypal-branded phishing pages on compromised or third-party sites

These domains are NOT lookalikes of Paypal - most are legitimate sites that have been compromised, or free-hosting space, serving a page that presents Paypal branding in a credential or payment context. The domain owner is usually a victim too; each row is about the hosted page, never an accusation against the domain itself.

DomainWorst verdictEvidenceScansFirst seenLast seenKitExample page
tubietelbar.hususpiciousphishing kit52026-08-152026-08-23generic paypal harvesterhttp://tubietelbar.hu/uploadfile/bozaxukepa.pdf
www.kindliving.orgsuspiciousphishing kit62026-08-152026-08-16generic paypal harvesterhttps://www.kindliving.org/w.../tmp/zixovukofegasozomid.pdf

Phishing kits used

Malware observed hosted on or communicating with these domains

None yet. That is the honest state, not a gap in the page: credential-harvesting phishing mostly collects logins rather than serving executables, so a domain can be actively hostile with no malware ever hosted on it. This section fills in only when a sample's runtime traffic, extracted configuration or download provenance evidences one of these domains - a hostname merely appearing inside a file's bytes is listed separately below and never counted here.

Samples containing one of these hostnames as a string

These samples merely CONTAIN one of the impersonating hostnames somewhere in their bytes - an embedded blocklist, a configuration template or a bundled report produces the same observation - so this is NOT evidence the sample ever contacted the domain, and it is never counted as an attack on Paypal.

How impersonation is detected

A page's CLAIMED identity (its title, og:site_name, favicon and phishing-kit fingerprint) is compared against evidence of who actually operates it: the certificate subject organisation, the RDAP registrant and the announcing network. A free domain-validated certificate asserts nothing about ownership, and that asymmetry is itself the signal. A page on Paypal's own apex with a matching certificate organisation is treated as the real property, not an impersonation, which is why this list does not include Paypal's own sites.

These are point-in-time observations. A domain listed here may since have been taken down, and absence from this list is not evidence a domain is safe.

Questions about Paypal phishing

How many domains are impersonating Paypal?
2 distinct domains, seen across 11 public URL scans, of which 2 currently carry a malicious or suspicious verdict.
How can I tell a fake Paypal site from the real one?
Compare what the page CLAIMS against who demonstrably operates it: the certificate subject organisation, the domain's registrant and the network announcing its address. A free domain-validated certificate proves control of the name and nothing about ownership, and that asymmetry is the signal - a real Paypal property does not need to borrow the brand's look.
Which phishing kits target Paypal?
generic paypal harvester (11 scans). A kit fingerprint means the page was built from a known toolkit rather than hand-made, which usually indicates a campaign rather than a one-off.
Is a domain safe if it is not listed here?
No. This lists what MalwareAnalyzer has scanned, not the whole internet, and a domain taken down yesterday still appears. Absence is not evidence of safety - scan the specific URL.

All brands under attack · Scan a URL · Latest analyzed threats · How URL scanning works