Phishing sites impersonating PayPal

PhishDestroy has recorded 420 phishing domains impersonating PayPal since 2025-08-07, 124 of them in the last 30 days. The most used registrars are Dynadot and Cloudflare; the most common TLDs are .shop and .com. The official PayPal domain is paypal.com: any other site asking for your login or wallet is not PayPal.

420
Domains, all time
124
Last 30 days
232
Online at last check
43
Confirmed takedowns

New domains in the last 90 days

2026-07-25: 02026-07-26: 22026-07-27: 42026-07-28: 02026-07-29: 52026-07-30: 12026-07-31: 32026-08-01: 02026-08-02: 02026-08-03: 22026-08-04: 12026-08-05: 02026-08-06: 12026-08-07: 02026-08-08: 02026-08-09: 02026-08-10: 22026-08-11: 12026-08-12: 12026-08-13: 12026-08-14: 62026-08-15: 32026-08-16: 02026-08-17: 02026-08-18: 22026-08-19: 02026-08-20: 12026-08-21: 02026-08-22: 12026-08-23: 22026-08-24: 12026-08-25: 02026-08-26: 02026-08-27: 02026-08-28: 02026-08-29: 02026-08-30: 02026-08-31: 52026-09-01: 02026-09-02: 02026-09-03: 12026-09-04: 12026-09-05: 02026-09-06: 02026-09-07: 12026-09-08: 22026-09-09: 62026-09-10: 32026-09-11: 32026-09-12: 32026-09-13: 02026-09-14: 12026-09-15: 22026-09-16: 02026-09-17: 02026-09-18: 02026-09-19: 12026-09-20: 22026-09-21: 12026-09-22: 32026-09-23: 02026-09-24: 22026-09-25: 32026-09-26: 12026-09-27: 12026-09-28: 22026-09-29: 02026-09-30: 02026-10-01: 52026-10-02: 62026-10-03: 12026-10-04: 12026-10-05: 22026-10-06: 12026-10-07: 132026-10-08: 22026-10-09: 102026-10-10: 62026-10-11: 22026-10-12: 02026-10-13: 112026-10-14: 02026-10-15: 02026-10-16: 102026-10-17: 72026-10-18: 22026-10-19: 12026-10-20: 272026-10-21: 22026-10-22: 5
PayPal phishing domains detected per day: 198 from 2026-07-25 to 2026-10-22; peak 27.

How to tell a fake PayPal site

Official domain: paypal.com.

Words most often added to the brand in reported domains: pay, konto, bankman, kra, one, versicherung, absicherung, dweb, duplicate, disabled.

  • Type the address yourself or use a bookmark; phishing links for PayPal arrive through ads, search results, direct messages and fake support accounts.
  • Check the full domain before you sign in: look for extra words, hyphens, a different TLD or look-alike letters.
  • PayPal does not ask you to confirm your password or card details through a link in an email or SMS.

Paste a suspicious address into the Homoglyph Checker or check it against the DestroyList.

Latest PayPal phishing domains

The 50 most recently detected domains impersonating PayPal
DomainFirst detectedStatus at last checkRegistrar
bonairehome.shop2026-10-22OnlineDynadot
bombshellstyles.shop2026-10-22Online—
bomboogieapparel.shop2026-10-22Online—
bombdesignswear.shop2026-10-22OnlineDynadot
bomaronline.shop2026-10-22OnlineDynadot
mydukepharmacy.shop2026-10-21OfflineDynadot
analogueapparel.com2026-10-21OnlineTUCOWS.COM
boldbistro.shop2026-10-20OfflineDynadot
boltcy.shop2026-10-20OfflineDynadot
boltstream.shop2026-10-20OfflineDynadot
bolengear.shop2026-10-20OfflineDynadot
boldseam.shop2026-10-20OfflineDynadot
boldstylewear.shop2026-10-20OfflineDynadot
boldtide.shop2026-10-20OnlineDynadot
boldcrest.shop2026-10-20OfflineDynadot
boldbrick.shop2026-10-20OfflineDynadot
boldmotion.shop2026-10-20OfflineDynadot
boldpivot.shop2026-10-20OfflineDYNADOT
bokacentral.shop2026-10-20OfflineDynadot
boholifestylestore.shop2026-10-20Offline—
bohespirit.shop2026-10-20Offline—
bohmeapparel.shop2026-10-20OfflineDynadot
bodywrappers.shop2026-10-20OfflineDynadot
bodycandyboutique.shop2026-10-20OfflineDynadot
bogcircuit.shop2026-10-20OfflineDynadot
bodytonefitness.shop2026-10-20OfflineDynadot
bodymodsjewelry.shop2026-10-20OfflineDynadot
bodyfitpro.shop2026-10-20Offline—
bodivibe.shop2026-10-20OfflineDynadot
bobbiegoodshome.shop2026-10-20OfflineDynadot
bobheadstudio.shop2026-10-20OfflineDynadot
bmxsourcehub.shop2026-10-20OfflineDynadot
boastclothing.shop2026-10-20OfflineDynadot
bndly.shop2026-10-20Offline—
fundhollowtrust.com2026-10-19OnlineNETIM
bluettiluxeoutdoorhq.shop2026-10-18OnlineDynadot
blueleafbathhome.shop2026-10-18OnlineDynadot
bloomchicfashion.shop2026-10-17OnlineDynadot
blandhome.shop2026-10-17OnlineDynadot
blackviewofficial.shop2026-10-17OnlineDynadot
blackviewonline.shop2026-10-17OnlineDynadot
blackviewitalia.shop2026-10-17OnlineDynadot
blackviewdirect.shop2026-10-17OnlineDynadot
blackmilkclothingstore.shop2026-10-17OnlineDynadot
strendus.vip2026-10-16OfflineDynadot
blackbananasstore.shop2026-10-16OnlineDynadot
bkindwellness.shop2026-10-16OnlineDynadot
billyjofficial.shop2026-10-16OnlineDynadot
billieeilishonline.shop2026-10-16OfflineDynadot
bikesonlinestore.shop2026-10-16OnlineDynadot

All 420 PayPal reports

Where they are registered and hosted

Registrars

  1. Dynadot118
  2. Cloudflare21
  3. NICENIC16
  4. PublicDomainRegistry.com14
  5. Wix Studio13
  6. NameCheap9
  7. GitHub9
  8. Vercel9

Top-level domains

  1. .shop134
  2. .com111
  3. .app28
  4. .dev19
  5. .io15
  6. .org10
  7. .net7
  8. .online7

Hosting networks

  1. Cloudflare, Inc.76
  2. Malakmadze Web LLC60
  3. malakmadze Malakmadze Web LLC, GE58
  4. Amazon.com, Inc.25
  5. CLOUDFLARENET, US16
  6. CLOUDFLARENET - Cloudflare, Inc., US12
  7. Google LLC11
  8. Fastly, Inc.7

Related

Data: PhishDestroy domain-report database, built 2026-10-22. Counts cover every reported domain whose stored target brand is PayPal; share of all PhishDestroy reports: 0.19%.