# Phishing sites impersonating PayPal PhishDestroy has recorded 420 phishing domains impersonating PayPal since 2025-08-07, 124 of them in the last 30 days. The most used registrars are Dynadot and Cloudflare; the most common TLDs are .shop and .com. The official PayPal domain is paypal.com: any other site asking for your login or wallet is not PayPal. 420Domains, all time 124Last 30 days 232Online at last check 43Confirmed takedowns ## New domains in the last 90 days PayPal phishing domains detected per day: 198 from 2026-07-25 to 2026-10-22; peak 27. ## How to tell a fake PayPal site Official domain: paypal.com. Words most often added to the brand in reported domains: pay, konto, bankman, kra, one, versicherung, absicherung, dweb, duplicate, disabled. - Type the address yourself or use a bookmark; phishing links for PayPal arrive through ads, search results, direct messages and fake support accounts. - Check the full domain before you sign in: look for extra words, hyphens, a different TLD or look-alike letters. - PayPal does not ask you to confirm your password or card details through a link in an email or SMS. Paste a suspicious address into the [Homoglyph Checker](https://phishdestroy.io/developer-tools/homoglyph-checker) or check it against the [DestroyList](https://phishdestroy.io/developer-tools/destroylist-check). ## Latest PayPal phishing domains The 50 most recently detected domains impersonating PayPal Domain | First detected | Status at last check | Registrar | [bonairehome.shop](https://phishdestroy.io/domain/bonairehome.shop/) | 2026-10-22 | Online | Dynadot | [bombshellstyles.shop](https://phishdestroy.io/domain/bombshellstyles.shop/) | 2026-10-22 | Online | — | [bomboogieapparel.shop](https://phishdestroy.io/domain/bomboogieapparel.shop/) | 2026-10-22 | Online | — | [bombdesignswear.shop](https://phishdestroy.io/domain/bombdesignswear.shop/) | 2026-10-22 | Online | Dynadot | [bomaronline.shop](https://phishdestroy.io/domain/bomaronline.shop/) | 2026-10-22 | Online | Dynadot | [mydukepharmacy.shop](https://phishdestroy.io/domain/mydukepharmacy.shop/) | 2026-10-21 | Offline | Dynadot | [analogueapparel.com](https://phishdestroy.io/domain/analogueapparel.com/) | 2026-10-21 | Online | TUCOWS.COM | [boldbistro.shop](https://phishdestroy.io/domain/boldbistro.shop/) | 2026-10-20 | Offline | Dynadot | [boltcy.shop](https://phishdestroy.io/domain/boltcy.shop/) | 2026-10-20 | Offline | Dynadot | [boltstream.shop](https://phishdestroy.io/domain/boltstream.shop/) | 2026-10-20 | Offline | Dynadot | [bolengear.shop](https://phishdestroy.io/domain/bolengear.shop/) | 2026-10-20 | Offline | Dynadot | [boldseam.shop](https://phishdestroy.io/domain/boldseam.shop/) | 2026-10-20 | Offline | Dynadot | [boldstylewear.shop](https://phishdestroy.io/domain/boldstylewear.shop/) | 2026-10-20 | Offline | Dynadot | [boldtide.shop](https://phishdestroy.io/domain/boldtide.shop/) | 2026-10-20 | Online | Dynadot | [boldcrest.shop](https://phishdestroy.io/domain/boldcrest.shop/) | 2026-10-20 | Offline | Dynadot | [boldbrick.shop](https://phishdestroy.io/domain/boldbrick.shop/) | 2026-10-20 | Offline | Dynadot | [boldmotion.shop](https://phishdestroy.io/domain/boldmotion.shop/) | 2026-10-20 | Offline | Dynadot | [boldpivot.shop](https://phishdestroy.io/domain/boldpivot.shop/) | 2026-10-20 | Offline | DYNADOT | [bokacentral.shop](https://phishdestroy.io/domain/bokacentral.shop/) | 2026-10-20 | Offline | Dynadot | [boholifestylestore.shop](https://phishdestroy.io/domain/boholifestylestore.shop/) | 2026-10-20 | Offline | — | [bohespirit.shop](https://phishdestroy.io/domain/bohespirit.shop/) | 2026-10-20 | Offline | — | [bohmeapparel.shop](https://phishdestroy.io/domain/bohmeapparel.shop/) | 2026-10-20 | Offline | Dynadot | [bodywrappers.shop](https://phishdestroy.io/domain/bodywrappers.shop/) | 2026-10-20 | Offline | Dynadot | [bodycandyboutique.shop](https://phishdestroy.io/domain/bodycandyboutique.shop/) | 2026-10-20 | Offline | Dynadot | [bogcircuit.shop](https://phishdestroy.io/domain/bogcircuit.shop/) | 2026-10-20 | Offline | Dynadot | [bodytonefitness.shop](https://phishdestroy.io/domain/bodytonefitness.shop/) | 2026-10-20 | Offline | Dynadot | [bodymodsjewelry.shop](https://phishdestroy.io/domain/bodymodsjewelry.shop/) | 2026-10-20 | Offline | Dynadot | [bodyfitpro.shop](https://phishdestroy.io/domain/bodyfitpro.shop/) | 2026-10-20 | Offline | — | [bodivibe.shop](https://phishdestroy.io/domain/bodivibe.shop/) | 2026-10-20 | Offline | Dynadot | [bobbiegoodshome.shop](https://phishdestroy.io/domain/bobbiegoodshome.shop/) | 2026-10-20 | Offline | Dynadot | [bobheadstudio.shop](https://phishdestroy.io/domain/bobheadstudio.shop/) | 2026-10-20 | Offline | Dynadot | [bmxsourcehub.shop](https://phishdestroy.io/domain/bmxsourcehub.shop/) | 2026-10-20 | Offline | Dynadot | [boastclothing.shop](https://phishdestroy.io/domain/boastclothing.shop/) | 2026-10-20 | Offline | Dynadot | [bndly.shop](https://phishdestroy.io/domain/bndly.shop/) | 2026-10-20 | Offline | — | [fundhollowtrust.com](https://phishdestroy.io/domain/fundhollowtrust.com/) | 2026-10-19 | Online | NETIM | [bluettiluxeoutdoorhq.shop](https://phishdestroy.io/domain/bluettiluxeoutdoorhq.shop/) | 2026-10-18 | Online | Dynadot | [blueleafbathhome.shop](https://phishdestroy.io/domain/blueleafbathhome.shop/) | 2026-10-18 | Online | Dynadot | [bloomchicfashion.shop](https://phishdestroy.io/domain/bloomchicfashion.shop/) | 2026-10-17 | Online | Dynadot | [blandhome.shop](https://phishdestroy.io/domain/blandhome.shop/) | 2026-10-17 | Online | Dynadot | [blackviewofficial.shop](https://phishdestroy.io/domain/blackviewofficial.shop/) | 2026-10-17 | Online | Dynadot | [blackviewonline.shop](https://phishdestroy.io/domain/blackviewonline.shop/) | 2026-10-17 | Online | Dynadot | [blackviewitalia.shop](https://phishdestroy.io/domain/blackviewitalia.shop/) | 2026-10-17 | Online | Dynadot | [blackviewdirect.shop](https://phishdestroy.io/domain/blackviewdirect.shop/) | 2026-10-17 | Online | Dynadot | [blackmilkclothingstore.shop](https://phishdestroy.io/domain/blackmilkclothingstore.shop/) | 2026-10-17 | Online | Dynadot | [strendus.vip](https://phishdestroy.io/domain/strendus.vip/) | 2026-10-16 | Offline | Dynadot | [blackbananasstore.shop](https://phishdestroy.io/domain/blackbananasstore.shop/) | 2026-10-16 | Online | Dynadot | [bkindwellness.shop](https://phishdestroy.io/domain/bkindwellness.shop/) | 2026-10-16 | Online | Dynadot | [billyjofficial.shop](https://phishdestroy.io/domain/billyjofficial.shop/) | 2026-10-16 | Online | Dynadot | [billieeilishonline.shop](https://phishdestroy.io/domain/billieeilishonline.shop/) | 2026-10-16 | Offline | Dynadot | [bikesonlinestore.shop](https://phishdestroy.io/domain/bikesonlinestore.shop/) | 2026-10-16 | Online | Dynadot | [All 420 PayPal reports](https://phishdestroy.io/domain/?brand=PayPal) ## Where they are registered and hosted ### Registrars - [Dynadot](https://phishdestroy.io/registrar/dynadot/)118 - Cloudflare21 - [NICENIC](https://phishdestroy.io/registrar/nicenic/)16 - [PublicDomainRegistry.com](https://phishdestroy.io/registrar/publicdomainregistry-pdr/)14 - Wix Studio13 - [NameCheap](https://phishdestroy.io/registrar/namecheap/)9 - GitHub9 - Vercel9 ### Top-level domains - [.shop](https://phishdestroy.io/tld/shop/)134 - [.com](https://phishdestroy.io/tld/com/)111 - [.app](https://phishdestroy.io/tld/app/)28 - [.dev](https://phishdestroy.io/tld/dev/)19 - [.io](https://phishdestroy.io/tld/io/)15 - [.org](https://phishdestroy.io/tld/org/)10 - [.net](https://phishdestroy.io/tld/net/)7 - [.online](https://phishdestroy.io/tld/online/)7 ### Hosting networks - Cloudflare, Inc.76 - Malakmadze Web LLC60 - malakmadze Malakmadze Web LLC, GE58 - Amazon.com, Inc.25 - CLOUDFLARENET, US16 - CLOUDFLARENET - Cloudflare, Inc., US12 - Google LLC11 - Fastly, Inc.7 ## Related - [Typosquatting](https://phishdestroy.io/glossary/typosquatting/) - [Homoglyph](https://phishdestroy.io/glossary/homoglyph/) - [Phishing kit](https://phishdestroy.io/glossary/phishing-kit/) - [Homoglyph Checker](https://phishdestroy.io/developer-tools/homoglyph-checker) - [Abuse Report Generator](https://phishdestroy.io/developer-tools/abuse-report-generator) - [If you already used a fake site: emergency guide](https://phishdestroy.io/critical-action) - [All impersonated brands](https://phishdestroy.io/brand/) Data: PhishDestroy domain-report database, built 2026-10-22. Counts cover every reported domain whose stored target brand is PayPal; share of all PhishDestroy reports: 0.19%. Canonical: https://phishdestroy.io/brand/paypal/