digi11[.]ict[.]ph

PhishDestroy identified digi11.ict.ph as a sophisticated phishing site that posed as a legitimate PayPal login page, but with a twist: its page title displayed 'Zimbra Web Client Sign In,' indicating a possible multi-purpose or misconfigured scam. The site aimed to steal sensitive login credentials from unsuspecting visitors who believed they were accessing PayPal. This type of brand impersonation attack is particularly dangerous because it exploits trust in well-known financial brands, often leading to financial fraud or identity theft.

The evidence against this domain is overwhelming. It was created on May 19, 2026, and resolved to IP address 91.98.186.91. VirusTotal flagged it with 17 out of 95 security vendors detecting malicious activity, and it appeared on one security blocklist. The SSL certificate was issued by Let's Encrypt / R12, a common choice for both legitimate and malicious sites. These indicators, combined with the fact that it impersonated PayPal, confirm its malicious intent. The domain has since been taken down, but similar threats emerge daily.

If you visited digi11.ict.ph and entered any credentials, change your PayPal password immediately and enable two-factor authentication. Monitor your accounts for unauthorized transactions and consider placing a fraud alert on your credit reports. PhishDestroy recommends always verifying the URL of any login page and using bookmarks for sensitive sites. Stay vigilant and report suspicious domains to authorities.