ctp21039[.]top

PhishDestroy’s ongoing investigation has flagged ctp21039.top as a live PayPal brand impersonation phishing site targeting unsuspecting users. The domain employs spoofed login pages designed to harvest PayPal credentials, payment information, and personal data under the guise of a routine security or account update. Once harvested, attackers can execute unauthorized transactions, lock legitimate accounts, and commit identity fraud. The page relies on psychological pressure—urgent language and fake alerts—to override caution, making it especially dangerous for mobile users on slow connections where visual cues are harder to spot.

This domain was flagged within hours of its April 05, 2025 creation. Registry data shows registration through Gname.com Pte. Ltd., and the site resolves to IP 172.67.202.188 behind an active Google Trust Services SSL certificate. VirusTotal currently shows 0 detections out of 95 scanning engines, indicating it remains unflagged by most antivirus platforms as of today. The combination of a freshly minted domain, low reputation IP space, and valid TLS certificate is a common tactic to evade detection while building trust with victims.

If you visited ctp21039.top or entered any credentials, assume your PayPal account has been compromised. Immediately log in through PayPal’s official app or website—never via email links or search results—and enable two-factor authentication. Revoke any unfamiliar devices linked to your account, change passwords everywhere reused, and monitor bank statements for unauthorized charges. Report the incident to PayPal’s fraud line and file a complaint with your national cybercrime unit. If you did not submit information but remain concerned, run a full antivirus scan and check browser extensions for unauthorized access. Share this alert to help others avoid the same trap.