Scan report · 2 months agoPublic

payme-paypal.com

188.114.96.4AS13335 · US

Submittedhttp://payme-paypal.com

Landed onhttps://payme-paypal.com/

Engine tags

Verdict

2 of 6 enginesMaliciousAutomated

Own this site?

What happened

Step by step, from what the scanner recorded.

Load 1.4 s · 8 requests

01 · Visitor openspayme-paypal.com

02 · Redirected · 1 hopSame host, another address

03 · Page shown

Zahlungsanfrage erhalten | PayPalstyled as PayPal · medium

04 · Data sent todiscord.com/api/webhooks/<redacted>

05 · OutcomeWhatever is typed leaves the pageA collection endpoint was observed; anything entered is treated as exposed.

Dangerous — confirmed threat

Automated

Its page title claims to be PayPal, which this address is not associated with. What you type is sent to discord — a route attackers use to collect stolen details. It is listed on external threat-intelligence feeds. We found strong evidence that this site is malicious — for example a phishing page, a scam, or hostile code. Treat anything it asked for (passwords, card details, codes) as exposed.

What to do

Do not enter any information or download anything. If you already did, change those passwords now and contact your bank if payment details were involved. Block or report the link to your team.

This reflects the evidence found at the time of the scan. If you believe it is a mistake, you can escalate it for analyst review.

Findings

Strongest first

StrongCredential-exfiltration endpoint detected

discord: discord.com/api/webhooks/<redacted>

The page contacted an endpoint used to steal entered data (e.g. a Telegram bot, Discord webhook, or request-catcher). Legitimate sites never send form data to these services.

Analyst noteDefinitive: Telegram/Discord/request-proxy exfil = credential theft. Treat as malicious; capture the endpoint for an IOC/takedown.

InfoBrand impersonation detected

PayPal · medium

The page presents itself as a known brand (brand keywords/branding detected).

Analyst noteLow/medium confidence (keyword only) — can be a news article or partner page. Corroborate before acting.

Infrastructure

IP: 188.114.96.4CLOUDFLARENET - Cloudflare, Inc., US · AS13335US
Redirects: 0 hops · / → /

WHOIS

Registrar: Cloudflare, Inc.
Created: Jun 26, 2026
Expires: Jun 26, 2027
Nameservers: athena.ns.cloudflare.comroman.ns.cloudflare.com

7 malicious1 suspicious

Hashes & fingerprints

Page Hash66985a09d6c75b1c1c4a4b7b810a2aa7c595fbfd79127a435cbf95f3faaeabd8 Favicon Hash538cf688eaad3d9891630f7d369a9e6d34e125011520853739b44b72869e42eb DOM Hash99709963f3f016cfca1ffe13f7f02fdb411ba3da7fdb84c72490eb80bf4ca09f Screenshot pHashc59f3ae0c51fd0e0

Page capture

Live

Title “Zahlungsanfrage erhalten | PayPal” · brand shown: PayPal (medium)

Visit Site

Engines

6 · time to verdict