solburn[.]run

PhishDestroy has identified the domain solburn.run as an active phishing site designed to impersonate PayPal and steal user credentials. When accessed, the page appears to mimic the official PayPal login screen, tricking visitors into entering their email and password. This stolen information is then harvested by cybercriminals for account takeovers, financial fraud, or sold on dark web markets. Users who enter their credentials are urged to change their PayPal password immediately and enable two-factor authentication to secure their accounts.

This domain was flagged by PhishDestroy on December 03, 2025, the same day it was registered. It resolves to the IP address 188.114.97.3 and uses a Google Trust Services SSL certificate to appear legitimate. The domain was registered through PDR Ltd. d/b/a PublicDomainRegistry.com, a registrar known for hosting both legitimate and malicious domains. Notably, VirusTotal currently shows 0 detections out of 95 security vendors, meaning standard antivirus tools do not yet recognize it as malicious—highlighting the importance of proactive threat intelligence.

If you visited solburn.run or entered any information, assume your credentials may be compromised. Change your PayPal password immediately using the official website or app, and review recent transactions for unauthorized activity. Enable two-factor authentication in your PayPal security settings to add an extra layer of protection. Avoid clicking on links in unsolicited emails or messages claiming to be from PayPal. If you’re unsure about a communication, log in directly through the official PayPal website. Report the domain to PayPal’s fraud team and consider running a malware scan on your device. Stay vigilant against evolving phishing tactics and verify URLs carefully before entering sensitive information.