# petronad.xyz — SUSPICIOUS

> Beware: petronad.xyz is a PayPal credential phishing site. VirusTotal shows 0/95 detections. Check the full report.

## Summary
PhishDestroy identifies petronad.xyz as a live PayPal credential phishing domain currently under investigation. This fraudulent site mimics PayPal’s login page to trick visitors into surrendering their account credentials and financial data. Once harvested, stolen credentials can be used to drain bank accounts, make unauthorized purchases, or launch follow-on attacks against the victim’s contacts. If you see a prompt to log in after clicking a link or visiting this domain, assume it is hostile and close the tab immediately.


This domain was flagged by PhishDestroy on November 21, 2025. Technical analysis reveals it resolves to IP 104.26.7.114 and was created on November 19, 2025—just two days prior—via HOSTINGER operations, UAB. VirusTotal currently shows 0 detections out of 95 scanning engines, meaning antivirus and browser defenses have not yet blacklisted the page. The site also holds a Google Trust Services SSL certificate, giving it the superficial appearance of legitimacy. These combined factors make the threat both recent and stealthy, increasing the risk of successful compromise.


If you visited petronad.xyz or entered any information, act quickly to secure your accounts. Change your PayPal password immediately using the official PayPal website or app—never through a link you clicked. Enable two-factor authentication on PayPal and any other financial services tied to the same email address. Review recent transactions for unauthorized charges and report any fraud to PayPal’s dispute center. Consider running a malware scan on your device and monitor email inboxes for follow-on phishing messages. Report the domain to PhishDestroy and your email provider to help block further attacks.

## Threat Details
- Verdict: SUSPICIOUS
- Site status: unknown (HTTP ?)

## Domain Intelligence
- Registered: 2025-11-19 13:37:58
- Registrar: HOSTINGER operations, UAB
- IP: 104.26.7.114

## Detection Status
- VirusTotal: 0 vendors flagged
- Google Safe Browsing: clean
- Blocklists: 0 hits

## Evidence
- Cloudflare Radar: https://radar.cloudflare.com/scan/0d8cf7e4-2c27-4d16-b2aa-59f490757d68
- PhishDestroy: https://phishdestroy.io/domain/petronad.xyz/
- LLM endpoint: https://phishdestroy.io/domain/petronad.xyz/llm.txt

## If You Visited This Site
1. Change any passwords you may have entered
2. Enable 2FA on all related accounts
3. Monitor your accounts for unauthorized activity
4. Report to: FBI IC3, Europol, local authorities

---
Report by PhishDestroy | https://phishdestroy.io/domain/petronad.xyz/
Last updated: 2026-03-24