spendsheep[.]today

Analysis of spendsheep.today, registered through NICENIC INTERNATIONAL GROUP CO., LIMITED, indicates active phishing infrastructure targeting PayPal users. The domain resolves to 68.183.98.54, a US-based IP hosted by DigitalOcean, LLC, and is served by DigitalOcean nameservers. The page title 'Payram' suggests a likely attempt to mimic PayPal’s branding, though the exact content and functionality of the site remain unconfirmed as of this report. As of July 19, 2026, the domain returns an HTTP 200 status, confirming it is live and accessible. Four of 91 security vendors on VirusTotal have flagged the domain, and it appears in two AlienVault OTX threat intelligence pulses, reinforcing its malicious classification. The domain is also present on at least one security blocklist and is actively blocked by PhishDestroy. The SSL certificate is issued by Let’s Encrypt, which is commonly used by both legitimate and malicious sites. Defenders should treat this domain as high-risk, block it at the network level, and monitor for related indicators, including the associated IP and nameserver infrastructure. Further investigation into the site’s payload and targeting mechanisms is recommended, though no specific phishing kit or additional technical artifacts have been identified at this time.