huewax[.]com

PhishDestroy has flagged huewax.com as an active PayPal credential-harvesting scam detected on March 23, 2026. The domain resolves to IP 188.114.96.3 and currently remains undetected by 95 sandbox engines at VirusTotal. Registered through GMO Internet, Inc. with a Let’s Encrypt SSL certificate, the site has existed for only a few weeks, suggesting opportunistic abuse of a newly created domain. This domain employs deceptive visual mimicry of PayPal’s login portal to trick visitors into surrendering email, password, and security question answers. The infrastructure hosting the scam—an IPv4 address shared with multiple other low-reputation domains—was allocated by Cloudflare and shows no prior history of legitimate use. The short domain age combined with zero detections indicates the threat actor is actively testing the campaign against automated detection systems before broader distribution via phishing emails or smishing texts. If you visited huewax.com, assume your PayPal credentials and linked financial data may have been compromised. Disconnect any active sessions, revoke saved payment methods in your PayPal account, and enable two-factor authentication immediately. Report the incident to PayPal’s fraud team and change passwords everywhere the same email address or password was reused. Consider a device scan with up-to-date antivirus software to rule out follow-on malware installations.