xn--paypalgebhrenrechner-xec[.]de

The domain xn--paypalgebhrenrechner-xec.de, which impersonates PayPal, has been flagged by 19 out of 95 vendors on VirusTotal as malicious. This phishing site, now offline, was designed to deceive users by mimicking PayPal's branding. It also featured elements from other popular brands such as Facebook, Instagram, and YouTube, aiming to enhance its credibility.

Hosted on an IP address registered to Namecheap, Inc. in the United States, the domain used an SSL certificate issued by Sectigo Limited. Despite its current offline status, the site previously posed a significant threat by leveraging the trust associated with the PayPal brand to execute ecommerce scams. Its platform risk score was relatively low at 10/100, indicating a potential for broader exploitation if it were still active.

The domain's detection by PhishDestroy on October 25, 2025, highlights the importance of early identification in combating phishing threats. While public blocklists such as PhishDestroy and PhishingDB have included this domain, the presence of 19 VirusTotal detections underscores the site's malicious nature. The rapid takedown of xn--paypalgebhrenrechner-xec.de demonstrates effective intervention but also serves as a reminder of the continuous vigilance required to protect users from phishing scams.