Website safety scanner

Is paypa1.com legit?

Be careful with this website

Our scanner found several signals that may make paypa1.com risky for visitors. Avoid payments, logins or downloads unless you can verify the site independently.

Our score 39/100

High caution

Threat lists Match found Warning

SSL Unclear Check

Domain age 9510 days Established

Email protection Protected Passed

Popularity Low data Unknown

Our verdict

Our automated scanner gives paypa1.com a trust score of 39/100. Stronger trust signals include Configured free blacklist checks did not report a match, Abuse confidence score 0/100, 9510 days old. The main warnings or unknowns are 11 malicious detections, SSL could not be checked because the host was unavailable or blocked by the security policy., https://www.paypal.com/nl/home.

This is an automated trust analysis. It checks technical signals, public threat feeds, domain records and website configuration. It cannot prove intent, but it helps you decide whether extra caution is needed before you log in, pay, download files or share personal information.

Recommended action Do not enter payment details, passwords or personal information unless you can verify the website through an official source.

Website preview

Preview image generated from the scanned homepage. Visual appearance can change after the scan.

What to watch for

VirusTotal malicious detections -35 11 malicious detections
Missing or invalid SSL -18 SSL could not be checked because the host was unavailable or blocked by the security policy.
Redirects to another domain -10 https://www.paypal.com/nl/home
Possible brand impersonation pattern -12 paypal

What this means for you

Browsing the homepage: review normally, but watch for browser warnings or forced downloads.
Entering passwords: only continue if the domain clearly matches the official website.
Payments: verify company details, refund policy and payment method first.
Downloads: avoid files when threat intelligence or reputation warnings are present.

Is paypa1.com safe to use?

paypa1.com currently has a low trust profile in our automated analysis. The score combines blacklist results, SSL status, DNS configuration, WHOIS data, redirect behavior, security headers, domain heuristics, IP reputation and popularity signals.

A high score does not guarantee that a website is legitimate, and a low score does not prove criminal intent. The purpose of this report is to show the technical evidence so visitors can make a more informed decision.

Brand and domain checks

Brand-like pattern: Possible match: paypal
Redirects elsewhere: Yes
Final URL: https://www.paypal.com/nl/home
Punycode detected: No

Contact and company signals

About page: Yes
Contact page: Yes
Privacy policy: Yes
Terms page: No
Refund policy: No

Payment risk indicators

Risk terms found: No data available
External links: 18
Recommendation: Do not enter payment details, passwords or personal information unless you can verify the website through an official source.

Trust signals found

No phishing list match found Configured free blacklist checks did not report a match
AbuseIPDB clean IP score Abuse confidence score 0/100
Established domain age 9510 days old
MX records present Mail exchange records found
SPF record present SPF policy found
DMARC record present DMARC policy found
Good security headers content-security-policy, strict-transport-security, x-content-type-options, permissions-policy
Company information pages found about page, contact page, privacy policy

Website popularity

5 Popularity score

11-04

Rank source: Tranco
Tranco rank: No data available
Estimated visitors: No reliable estimate available

Additional threat intelligence

AlienVault OTX pulses: 0
OTX reputation: No data available
AbuseIPDB score: 0/100
AbuseIPDB reports: 0
IP owner / ISP: Amazon Technologies Inc.

VirusTotal details

Malicious detections: 11
Suspicious detections: 1
Harmless engines: 48
Undetected engines: 32
Reputation: 2
Community votes: harmless: 2, malicious: 0
Categories: alphaMountain.ai: Finance, Phishing (alphaMountain.ai), Sophos: phishing and fraud, Forcepoint ThreatSeeker: phishing and other frauds. financial data and services

Detected threats by engine

Engine	Category	Result	Method
alphaMountain.ai	malicious	phishing	blacklist
BitDefender	malicious	phishing	blacklist
Chong Lua Dao	malicious	malicious	blacklist
CyRadar	malicious	phishing	blacklist
Forcepoint ThreatSeeker	malicious	phishing	blacklist
Fortinet	malicious	phishing	blacklist
G-Data	malicious	phishing	blacklist
Lionic	malicious	phishing	blacklist
Seclookup	malicious	malicious	blacklist
SOCRadar	suspicious	suspicious	blacklist
Sophos	malicious	phishing	blacklist
VIPRE	malicious	phishing	blacklist

View all stored VirusTotal output

{
    "creation_date": 972083827,
    "whois": "Creation Date: 2000-10-20T23:17:07.000+00:00\nCreation Date: 2000-10-20T23:17:07Z\nDNSSEC: unsigned\nDomain Name: PAYPA1.COM\nDomain Name: paypa1.com\nDomain Status: clientDeleteProhibited\nDomain Status: clientDeleteProhibited https://icann.org/epp#clientDeleteProhibited\nDomain Status: clientTransferProhibited\nDomain Status: clientTransferProhibited https://icann.org/epp#clientTransferProhibited\nDomain Status: clientUpdateProhibited\nDomain Status: clientUpdateProhibited https://icann.org/epp#clientUpdateProhibited\nName Server Last Changed: 2015-05-26T19:56:48.000+00:00 (most recent)\nName Server Status: active\nName Server: NS1.MARKMONITOR.COM\nName Server: NS2.MARKMONITOR.COM\nName Server: NS3.MARKMONITOR.COM\nName Server: NS4.MARKMONITOR.COM\nName Server: NS5.MARKMONITOR.COM\nName Server: NS6.MARKMONITOR.COM\nName Server: NS7.MARKMONITOR.COM\nName Server: ns1.markmonitor.com\nName Server: ns2.markmonitor.com\nName Server: ns3.markmonitor.com\nName Server: ns4.markmonitor.com\nName Server: ns5.markmonitor.com\nName Server: ns6.markmonitor.com\nName Server: ns7.markmonitor.com\nRegistrant City: 1f8f4166599d23ee\nRegistrant Contact URL: 076d5be2270939a9\nRegistrant Country: US\nRegistrant Email: 2d8644446d24f14as@\nRegistrant Name: c6b4890b5600303f\nRegistrant Organization: 1f8f4166599d23ee\nRegistrant Phone: 1f8f4166599d23ee\nRegistrant Postal Code: 1f8f4166599d23ee\nRegistrant State/Province: b1952dfc047df18a\nRegistrant Street: 1f8f4166599d23ee\nRegistrar Abuse Contact Email: abusecomplaints@markmonitor.com\nRegistrar Abuse Contact Name: Markmonitor Inc.\nRegistrar Abuse Contact Phone: +1.2086851750\nRegistrar Abuse Contact: https://corp.markmonitor.com/domain/ui/abuse-report\nRegistrar City: Meridian\nRegistrar Contact URL: https://www.markmonitor.com/contact-us/\nRegistrar Country: US\nRegistrar IANA ID: 292\nRegistrar Organization: Markmonitor Inc.\nRegistrar Postal Code: 83646\nRegistrar Registration Expiration Date: 2027-10-20T23:17:07.000+00:00\nRegistrar State/Province: ID\nRegistrar Street: 3540 E Longwing Ln\nRegistrar URL: http://www.markmonitor.com\nRegistrar WHOIS Server: whois.markmonitor.com\nRegistrar: MarkMonitor Inc.\nRegistrar: Markmonitor Inc.\nRegistry Domain ID: 38133806_DOMAIN_COM-VRSN\nRegistry Expiry Date: 2027-10-20T00:00:00.000+00:00\nRegistry Expiry Date: 2027-10-20T23:17:07Z\nTech Contact URL: https://domains.markmonitor.com/whois/contact/paypa1.com\nUpdated Date: 2026-09-18T11:41:48Z\nUpdated Date: 2026-09-18T11:41:49.000+00:00",
    "last_dns_records_date": 1793702122,
    "registrar": "MarkMonitor Inc.",
    "last_analysis_stats": {
        "malicious": 11,
        "suspicious": 1,
        "undetected": 32,
        "harmless": 48,
        "timeout": 0
    },
    "last_analysis_date": 1793701791,
    "last_dns_records": [
        {
            "type": "NS",
            "ttl": 21600,
            "value": "ns6.markmonitor.com"
        },
        {
            "type": "NS",
            "ttl": 21600,
            "value": "ns3.markmonitor.com"
        },
        {
            "type": "NS",
            "ttl": 21600,
            "value": "ns5.markmonitor.com"
        },
        {
            "type": "NS",
            "ttl": 21600,
            "value": "ns7.markmonitor.com"
        },
        {
            "type": "TXT",
            "ttl": 11316,
            "value": "v=spf1 -all"
        },
        {
            "type": "MX",
            "ttl": 21600,
            "priority": 1,
            "value": "bh.markmonitor.com"
        },
        {
            "type": "NS",
            "ttl": 21600,
            "value": "ns1.markmonitor.com"
        },
        {
            "type": "SOA",
            "ttl": 21600,
            "value": "ns1.markmonitor.com",
            "rname": "hostmaster.markmonitor.com",
            "serial": 2026102101,
            "refresh": 86400,
            "retry": 3600,
            "expire": 2592000,
            "minimum": 172800
        },
        {
            "type": "NS",
            "ttl": 21600,
            "value": "ns2.markmonitor.com"
        },
        {
            "type": "A",
            "ttl": 3600,
            "value": "3.33.139.32"
        },
        {
            "type": "NS",
            "ttl": 21600,
            "value": "ns4.markmonitor.com"
        }
    ],
    "expiration_date": 1824074227,
    "last_modification_date": 1793778611,
    "popularity_ranks": {
        "Cisco Umbrella": {
            "rank": 917576,
            "timestamp": 1767191894
        },
        "Cloudflare Radar": {
            "rank": 1000000,
            "timestamp": 1782052696
        }
    },
    "categories": {
        "alphaMountain.ai": "Finance, Phishing (alphaMountain.ai)",
        "Sophos": "phishing and fraud",
        "Forcepoint ThreatSeeker": "phishing and other frauds. financial data and services"
    },
    "rdap": {
        "handle": "38133806_DOMAIN_COM-VRSN",
        "ldh_name": "paypa1.com",
        "events": [
            {
                "event_action": "registrar expiration",
                "event_date": "2027-10-20T23:17:07.000+00:00",
                "event_actor": "",
                "links": []
            },
            {
                "event_action": "expiration",
                "event_date": "2027-10-20T00:00:00.000+00:00",
                "event_actor": "",
                "links": []
            },
            {
                "event_action": "registration",
                "event_date": "2000-10-20T23:17:07.000+00:00",
                "event_actor": "",
                "links": []
            },
            {
                "event_action": "last changed",
                "event_date": "2026-09-18T11:41:49.000+00:00",
                "event_actor": "",
                "links": []
            },
            {
                "event_action": "last update of RDAP database",
                "event_date": "2026-11-02T17:10:18.000+00:00",
                "event_actor": "",
                "links": []
            }
        ],
        "notices": [
            {
                "title": "Terms of Use",
                "description": [
                    "By submitting an RDAP query, you agree that you will use this data only for",
                    "lawful purposes and that, under no circumstances will you use this data to:",
                    "(1) allow, enable, or otherwise support the transmission by email, telephone,",
                    "or facsimile of mass, unsolicited, commercial advertising, or spam; or",
                    "(2) enable high volume, automated, or electronic processes that send queries,",
                    "data, or email to Markmonitor (or its systems) or the domain name contacts (or",
                    "its systems).",
                    "Markmonitor reserves the right to modify these terms at any time.",
                    "By submitting this query, you agree to abide by this policy.",
                    "Markmonitor Domain Management(TM)",
                    "Protecting companies and consumers in a digital world.",
                    "Visit Markmonitor at https://www.markmonitor.com",
                    "Contact us at +1.8007459229",
                    "In Europe, at +44.02032062220"
                ],
                "links": [
                    {
                        "href": "https://www.markmonitor.com/legal/domain-management-terms-and-conditions",
                        "rel": "related",
                        "type": "terms-of-service",
                        "value": "https://www.markmonitor.com/legal/domain-management-terms-and-conditions",
                        "title": "",
                        "media": "",
                        "href_lang": []
                    }
                ],
                "type": ""
            },
            {
                "title": "Status Codes",
                "description": [
                    "For more information on domain status codes, please visit https://icann.org/epp"
                ],
                "links": [
                    {
                        "href": "https://icann.org/epp",
                        "rel": "glossary",
                        "type": "text/html",
                        "value": "https://rdap.markmonitor.com/rdap/domain/paypa1.com",
                        "title": "",
                        "media": "",
                        "href_lang": []
                    }
                ],
                "type": ""
            },
            {
                "title": "RDDS Inaccuracy Complaint Form",
                "description": [
                    "URL of the ICANN RDDS Inaccuracy Complaint Form: https://icann.org/wicf"
                ],
                "links": [
                    {
                        "href": "https://icann.org/wicf",
                        "rel": "help",
                        "type": "text/html",
                        "value": "https://rdap.markmonitor.com/rdap/domain/paypa1.com",
                        "title": "",
                        "media": "",
                        "href_lang": []
                    }
                ],
                "type": ""
            }
        ],
        "nameservers": [
            {
                "ldh_name": "ns1.markmonitor.com",
                "events": [
                    {
                        "event_action": "last changed",
                        "event_date": "2015-05-26T19:56:48.000+00:00",
                        "event_actor": "",
                        "links": []
                    }
                ],
                "object_class_name": "nameserver",
                "status": [
                    "active"
                ],
                "handle": "",
                "unicode_name": "",
                "links": [],
                "notices": [],
                "lang": "",
                "port43": "",
                "entities": [],
                "remarks": []
            },
            {
                "ldh_name": "ns2.markmonitor.com",
                "events": [
                    {
                        "event_action": "last changed",
                        "event_date": "2015-05-26T19:56:48.000+00:00",
                        "event_actor": "",
                        "links": []
                    }
                ],
                "object_class_name": "nameserver",
                "status": [
                    "active"
                ],
                "handle": "",
                "unicode_name": "",
                "links": [],
                "notices": [],
                "lang": "",
                "port43": "",
                "entities": [],
                "remarks": []
            },
            {
                "ldh_name": "ns3.markmonitor.com",
                "events": [
                    {
                        "event_action": "last changed",
                        "event_date": "2015-05-26T19:56:48.000+00:00",
                        "event_actor": "",
                        "links": []
                    }
                ],
                "object_class_name": "nameserver",
                "status": [
                    "active"
                ],
                "handle": "",
                "unicode_name": "",
                "links": [],
                "notices": [],
                "lang": "",
                "port43": "",
                "entities": [],
                "remarks": []
            },
            {
                "ldh_name": "ns4.markmonitor.com",
                "events": [
                    {
                        "event_action": "last changed",
                        "event_date": "2015-05-26T19:56:48.000+00:00",
                        "event_actor": "",
                        "links": []
                    }
                ],
                "object_class_name": "nameserver",
                "status": [
                    "active"
                ],
                "handle": "",
                "unicode_name": "",
                "links": [],
                "notices": [],
                "lang": "",
                "port43": "",
                "entities": [],
                "remarks": []
            },
            {
                "ldh_name": "ns5.markmonitor.com",
                "events": [
                    {
                        "event_action": "last changed",
                        "event_date": "2015-05-26T19:56:48.000+00:00",
                        "event_actor": "",
                        "links": []
                    }
                ],
                "object_class_name": "nameserver",
                "status": [
                    "active"
                ],
                "handle": "",
                "unicode_name": "",
                "links": [],
                "notices": [],
                "lang": "",
                "port43": "",
                "entities": [],
                "remarks": []
            },
            {
                "ldh_name": "ns6.markmonitor.com",
                "events": [
                    {
                        "event_action": "last changed",
                        "event_date": "2015-05-26T19:56:48.000+00:00",
                        "event_actor": "",
                        "links": []
                    }
                ],
                "object_class_name": "nameserver",
                "status": [
                    "active"
                ],
                "handle": "",
                "unicode_name": "",
                "links": [],
                "notices": [],
                "lang": "",
                "port43": "",
                "entities": [],
                "remarks": []
            },
            {
                "ldh_name": "ns7.markmonitor.com",
                "events": [
                    {
                        "event_action": "last changed",
                        "event_date": "2015-05-26T19:56:48.000+00:00",
                        "event_actor": "",
                        "links": []
                    }
                ],
                "object_class_name": "nameserver",
                "status": [
                    "active"
                ],
                "handle": "",
                "unicode_name": "",
                "links": [],
                "notices": [],
                "lang": "",
                "port43": "",
                "entities": [],
                "remarks": []
            }
        ],
        "rdap_conformance": [
            "rdap_level_0",
            "icann_rdap_technical_implementation_guide_0",
            "icann_rdap_technical_implementation_guide_1",
            "icann_rdap_response_profile_0",
            "icann_rdap_response_profile_1"
        ],
        "entities": [
            {
                "object_class_name": "entity",
                "vcard_array": [
                    {
                        "name": "version",
                        "type": "text",
                        "values": [
                            "4.0"
                        ],
                        "parameters": []
                    },
                    {
                        "name": "contact-uri",
                        "type": "uri",
                        "values": [
                            "https://domains.markmonitor.com/whois/contact/paypa1.com"
                        ],
                        "parameters": []
                    },
                    {
                        "name": "fn",
                        "type": "text",
                        "values": [
                            "REDACTED REGISTRANT"
                        ],
                        "parameters": []
                    },
                    {
                        "name": "org",
                        "parameters": {
                            "type": [
                                "work"
                            ]
                        },
                        "type": "text",
                        "values": [
                            "REDACTED FOR PRIVACY"
                        ]
                    },
                    {
                        "name": "adr",
                        "parameters": {
                            "cc": [
                                "US"
                            ]
                        },
                        "type": "text",
                        "values": [
                            "",
                            "",
                            "REDACTED FOR PRIVACY",
                            "REDACTED FOR PRIVACY",
                            "CA",
                            "REDACTED FOR PRIVACY",
                            ""
                        ]
                    },
                    {
                        "name": "tel",
                        "parameters": {
                            "type": [
                                "voice"
                            ]
                        },
                        "type": "text",
                        "values": [
                            "REDACTED FOR PRIVACY"
                        ]
                    },
                    {
                        "name": "email",
                        "type": "text",
                        "values": [
                            "REDACTED FOR PRIVACY"
                        ],
                        "parameters": []
                    }
                ],
                "roles": [
                    "registrant"
                ],
                "remarks": [
                    {
                        "title": "REDACTED FOR PRIVACY",
                        "description": [
                            "Some of the data in this object has been removed."
                        ],
                        "type": "object redacted due to authorization",
                        "links": []
                    }
                ],
                "events": [
                    {
                        "event_action": "last changed",
                        "event_date": "2022-10-14T16:21:37.000+00:00",
                        "event_actor": "",
                        "links": []
                    }
                ],
                "handle": "",
                "public_ids": [],
                "entities": [],
                "links": [],
                "as_event_actor": [],
                "status": [],
                "port43": "",
                "networks": [],
                "autnums": [],
                "url": "",
                "lang": "",
                "rdap_conformance": []
            },
            {
                "object_class_name": "entity",
                "vcard_array": [
                    {
                        "name": "version",
                        "type": "text",
                        "values": [
                            "4.0"
                        ],
                        "parameters": []
                    },
                    {
                        "name": "contact-uri",
                        "type": "uri",
                        "values": [
                            "https://domains.markmonitor.com/whois/contact/paypa1.com"
                        ],
                        "parameters": []
                    }
                ],
                "roles": [
                    "technical"
                ],
                "remarks": [
                    {
                        "title": "REDACTED FOR PRIVACY",
                        "description": [
                            "Some of the data in this object has been removed."
                        ],
                        "type": "object redacted due to authorization",
                        "links": []
                    }
                ],
                "events": [
                    {
                        "event_action": "last changed",
                        "event_date": "2022-10-14T16:21:37.000+00:00",
                        "event_actor": "",
                        "links": []
                    }
                ],
                "handle": "",
                "public_ids": [],
                "entities": [],
                "links": [],
                "as_event_actor": [],
                "status": [],
                "port43": "",
                "networks": [],
                "autnums": [],
                "url": "",
                "lang": "",
                "rdap_conformance": []
            },
            {
                "object_class_name": "entity",
                "handle": "292",
                "vcard_array": [
                    {
                        "name": "version",
                        "type": "text",
                        "values": [
                            "4.0"
                        ],
                        "parameters": []
                    },
                    {
                        "name": "org",
                        "parameters": {
                            "type": [
                                "work"
                            ]
                        },
                        "type": "text",
                        "values": [
                            "Markmonitor Inc."
                        ]
                    },
                    {
                        "name": "adr",
                        "parameters": {
                            "cc": [
                                "US"
                            ]
                        },
                        "type": "text",
                        "values": [
                            "",
                            "",
                            "3540 E Longwing Ln",
                            "Meridian",
                            "ID",
                            "83646",
                            ""
                        ]
                    },
                    {
                        "name": "contact-uri",
                        "type": "uri",
                        "values": [
                            "https://www.markmonitor.com/contact-us/"
                        ],
                        "parameters": []
                    },
                    {
                        "name": "fn",
                        "type": "text",
                        "values": [
                            "Markmonitor Inc."
                        ],
                        "parameters": []
                    }
                ],
                "roles": [
                    "registrar"
                ],
                "public_ids": [
                    {
                        "type": "IANA Registrar ID",
                        "identifier": "292"
                    }
                ],
                "entities": [
                    {
                        "object_class_name": "entity",
                        "vcard_array": [
                            {
                                "name": "version",
                                "type": "text",
                                "values": [
                                    "4.0"
                                ],
                                "parameters": []
                            },
                            {
                                "name": "contact-uri",
                                "parameters": {
                                    "type": [
                                        "work"
                                    ]
                                },
                                "type": "uri",
                                "values": [
                                    "https://corp.markmonitor.com/domain/ui/abuse-report"
                                ]
                            },
                            {
                                "name": "tel",
                                "parameters": {
                                    "type": [
                                        "voice"
                                    ]
                                },
                                "type": "text",
                                "values": [
                                    "+1.2086851750"
                                ]
                            },
                            {
                                "name": "fn",
                                "type": "text",
                                "values": [
                                    "Markmonitor Inc."
                                ],
                                "parameters": []
                            }
                        ],
                        "roles": [
                            "abuse"
                        ],
                        "handle": "",
                        "public_ids": [],
                        "entities": [],
                        "remarks": [],
                        "links": [],
                        "events": [],
                        "as_event_actor": [],
                        "status": [],
                        "port43": "",
                        "networks": [],
                        "autnums": [],
                        "url": "",
                        "lang": "",
                        "rdap_conformance": []
                    }
                ],
                "links": [
                    {
                        "href": "https://rdap.markmonitor.com/rdap/domain/paypa1.com",
                        "rel": "self",
                        "type": "application/rdap+json",
                        "value": "https://rdap.markmonitor.com/rdap/domain/paypa1.com",
                        "title": "",
                        "media": "",
                        "href_lang": []
                    },
                    {
                        "href": "https://www.markmonitor.com/about-us/",
                        "rel": "about",
                        "type": "text/html",
                        "value": "https://rdap.markmonitor.com/rdap/domain/paypa1.com",
                        "title": "",
                        "media": "",
                        "href_lang": []
                    }
                ],
                "remarks": [],
                "events": [],
                "as_event_actor": [],
                "status": [],
                "port43": "",
                "networks": [],
                "autnums": [],
                "url": "",
                "lang": "",
                "rdap_conformance": []
            }
        ],
        "object_class_name": "domain",
        "status": [
            "client update prohibited",
            "client transfer prohibited",
            "client delete prohibited"
        ],
        "secure_dns": {
            "delegation_signed": false,
            "zone_signed": false,
            "max_sig_life": 0,
            "ds_data": [],
            "key_data": []
        },
        "port43": "whois.markmonitor.com",
        "unicode_name": "",
        "punycode": "",
        "type": "",
        "links": [],
        "switch_name": "",
        "public_ids": [],
        "lang": "",
        "remarks": [],
        "nask0_state": "",
        "variants": []
    },
    "whois_date": 1792940041,
    "last_update_date": 1789731709,
    "tld": "com",
    "reputation": 2,
    "last_analysis_results": {
        "Acronis": {
            "method": "blacklist",
            "engine_name": "Acronis",
            "category": "harmless",
            "result": "clean"
        },
        "0xSI_f33d": {
            "method": "blacklist",
            "engine_name": "0xSI_f33d",
            "category": "undetected",
            "result": "unrated"
        },
        "Abusix": {
            "method": "blacklist",
            "engine_name": "Abusix",
            "category": "harmless",
            "result": "clean"
        },
        "ADMINUSLabs": {
            "method": "blacklist",
            "engine_name": "ADMINUSLabs",
            "category": "harmless",
            "result": "clean"
        },
        "Axur": {
            "method": "blacklist",
            "engine_name": "Axur",
            "category": "undetected",
            "result": "unrated"
        },
        "ChainPatrol": {
            "method": "blacklist",
            "engine_name": "ChainPatrol",
            "category": "undetected",
            "result": "unrated"
        },
        "Criminal IP": {
            "method": "blacklist",
            "engine_name": "Criminal IP",
            "category": "undetected",
            "result": "unrated"
        },
        "AILabs (MONITORAPP)": {
            "method": "blacklist",
            "engine_name": "AILabs (MONITORAPP)",
            "category": "harmless",
            "result": "clean"
        },
        "AlienVault": {
            "method": "blacklist",
            "engine_name": "AlienVault",
            "category": "harmless",
            "result": "clean"
        },
        "alphaMountain.ai": {
            "method": "blacklist",
            "engine_name": "alphaMountain.ai",
            "category": "malicious",
            "result": "phishing"
        },
        "AlphaSOC": {
            "method": "blacklist",
            "engine_name": "AlphaSOC",
            "category": "undetected",
            "result": "unrated"
        },
        "Antiy-AVL": {
            "method": "blacklist",
            "engine_name": "Antiy-AVL",
            "category": "harmless",
            "result": "clean"
        },
        "ArcSight Threat Intelligence": {
            "method": "blacklist",
            "engine_name": "ArcSight Threat Intelligence",
            "category": "undetected",
            "result": "unrated"
        },
        "AutoShun": {
            "method": "blacklist",
            "engine_name": "AutoShun",
            "category": "undetected",
            "result": "unrated"
        },
        "Bfore.Ai PreCrime": {
            "method": "blacklist",
            "engine_name": "Bfore.Ai PreCrime",
            "category": "harmless",
            "result": "clean"
        },
        "BitDefender": {
            "method": "blacklist",
            "engine_name": "BitDefender",
            "category": "malicious",
            "result": "phishing"
        },
        "Bkav": {
            "method": "blacklist",
            "engine_name": "Bkav",
            "category": "undetected",
            "result": "unrated"
        },
        "Blueliv": {
            "method": "blacklist",
            "engine_name": "Blueliv",
            "category": "harmless",
            "result": "clean"
        },
        "Certego": {
            "method": "blacklist",
            "engine_name": "Certego",
            "category": "harmless",
            "result": "clean"
        },
        "Chong Lua Dao": {
            "method": "blacklist",
            "engine_name": "Chong Lua Dao",
            "category": "malicious",
            "result": "malicious"
        },
        "CINS Army": {
            "method": "blacklist",
            "engine_name": "CINS Army",
            "category": "harmless",
            "result": "clean"
        },
        "CRDF": {
            "method": "blacklist",
            "engine_name": "CRDF",
            "category": "harmless",
            "result": "clean"
        },
        "CSIS Security Group": {
            "method": "blacklist",
            "engine_name": "CSIS Security Group",
            "category": "undetected",
            "result": "unrated"
        },
        "Snort IP sample list": {
            "method": "blacklist",
            "engine_name": "Snort IP sample list",
            "category": "undetected",
            "result": "unrated"
        },
        "CMC Threat Intelligence": {
            "method": "blacklist",
            "engine_name": "CMC Threat Intelligence",
            "category": "harmless",
            "result": "clean"
        },
        "CTX AI": {
            "method": "blacklist",
            "engine_name": "CTX AI",
            "category": "harmless",
            "result": "clean"
        },
        "Cyan": {
            "method": "blacklist",
            "engine_name": "Cyan",
            "category": "undetected",
            "result": "unrated"
        },
        "Cyble": {
            "method": "blacklist",
            "engine_name": "Cyble",
            "category": "harmless",
            "result": "clean"
        },
        "CyRadar": {
            "method": "blacklist",
            "engine_name": "CyRadar",
            "category": "malicious",
            "result": "phishing"
        },
        "DNS8": {
            "method": "blacklist",
            "engine_name": "DNS8",
            "category": "undetected",
            "result": "unrated"
        },
        "Dr.Web": {
            "method": "blacklist",
            "engine_name": "Dr.Web",
            "category": "harmless",
            "result": "clean"
        },
        "Ermes": {
            "method": "blacklist",
            "engine_name": "Ermes",
            "category": "undetected",
            "result": "unrated"
        },
        "ESET": {
            "method": "blacklist",
            "engine_name": "ESET",
            "category": "harmless",
            "result": "clean"
        },
        "ESTsecurity": {
            "method": "blacklist",
            "engine_name": "ESTsecurity",
            "category": "harmless",
            "result": "clean"
        },
        "EmergingThreats": {
            "method": "blacklist",
            "engine_name": "EmergingThreats",
            "category": "harmless",
            "result": "clean"
        },
        "Emsisoft": {
            "method": "blacklist",
            "engine_name": "Emsisoft",
            "category": "harmless",
            "result": "clean"
        },
        "Forcepoint ThreatSeeker": {
            "method": "blacklist",
            "engine_name": "Forcepoint ThreatSeeker",
            "category": "malicious",
            "result": "phishing"
        },
        "Fortinet": {
            "method": "blacklist",
            "engine_name": "Fortinet",
            "category": "malicious",
            "result": "phishing"
        },
        "Fortra": {
            "method": "blacklist",
            "engine_name": "Fortra",
            "category": "undetected",
            "result": "unrated"
        },
        "G-Data": {
            "method": "blacklist",
            "engine_name": "G-Data",
            "category": "malicious",
            "result": "phishing"
        },
        "GCP Abuse Intelligence": {
            "method": "blacklist",
            "engine_name": "GCP Abuse Intelligence",
            "category": "undetected",
            "result": "unrated"
        },
        "Google Safe Browsing": {
            "method": "blacklist",
            "engine_name": "Google Safe Browsing",
            "category": "harmless",
            "result": "clean"
        },
        "GreenSnow": {
            "method": "blacklist",
            "engine_name": "GreenSnow",
            "category": "harmless",
            "result": "clean"
        },
        "GreyNoise": {
            "method": "blacklist",
            "engine_name": "GreyNoise",
            "category": "undetected",
            "result": "unrated"
        },
        "Gridinsoft": {
            "method": "blacklist",
            "engine_name": "Gridinsoft",
            "category": "undetected",
            "result": "unrated"
        },
        "Guardpot": {
            "method": "blacklist",
            "engine_name": "Guardpot",
            "category": "undetected",
            "result": "unrated"
        },
        "Heimdal Security": {
            "method": "blacklist",
            "engine_name": "Heimdal Security",
            "category": "harmless",
            "result": "clean"
        },
        "Hunt.io Intelligence": {
            "method": "blacklist",
            "engine_name": "Hunt.io Intelligence",
            "category": "undetected",
            "result": "unrated"
        },
        "IPsum": {
            "method": "blacklist",
            "engine_name": "IPsum",
            "category": "harmless",
            "result": "clean"
        },
        "Juniper Networks": {
            "method": "blacklist",
            "engine_name": "Juniper Networks",
            "category": "harmless",
            "result": "clean"
        },
        "Kaspersky": {
            "method": "blacklist",
            "engine_name": "Kaspersky",
            "category": "harmless",
            "result": "clean"
        },
        "LevelBlue": {
            "method": "blacklist",
            "engine_name": "LevelBlue",
            "category": "harmless",
            "result": "clean"
        },
        "Lionic": {
            "method": "blacklist",
            "engine_name": "Lionic",
            "category": "malicious",
            "result": "phishing"
        },
        "Lumu": {
            "method": "blacklist",
            "engine_name": "Lumu",
            "category": "undetected",
            "result": "unrated"
        },
        "MalwarePatrol": {
            "method": "blacklist",
            "engine_name": "MalwarePatrol",
            "category": "harmless",
            "result": "clean"
        },
        "MalwareURL": {
            "method": "blacklist",
            "engine_name": "MalwareURL",
            "category": "undetected",
            "result": "unrated"
        },
        "Malwared": {
            "method": "blacklist",
            "engine_name": "Malwared",
            "category": "harmless",
            "result": "clean"
        },
        "Mimecast": {
            "method": "blacklist",
            "engine_name": "Mimecast",
            "category": "undetected",
            "result": "unrated"
        },
        "Netcraft": {
            "method": "blacklist",
            "engine_name": "Netcraft",
            "category": "undetected",
            "result": "unrated"
        },
        "OpenPhish": {
            "method": "blacklist",
            "engine_name": "OpenPhish",
            "category": "harmless",
            "result": "clean"
        },
        "Orcapot": {
            "method": "blacklist",
            "engine_name": "Orcapot",
            "category": "undetected",
            "result": "unrated"
        },
        "Phishing Database": {
            "method": "blacklist",
            "engine_name": "Phishing Database",
            "category": "harmless",
            "result": "clean"
        },
        "PhishFort": {
            "method": "blacklist",
            "engine_name": "PhishFort",
            "category": "undetected",
            "result": "unrated"
        },
        "Phishtank": {
            "method": "blacklist",
            "engine_name": "Phishtank",
            "category": "harmless",
            "result": "clean"
        },
        "PREBYTES": {
            "method": "blacklist",
            "engine_name": "PREBYTES",
            "category": "harmless",
            "result": "clean"
        },
        "PrecisionSec": {
            "method": "blacklist",
            "engine_name": "PrecisionSec",
            "category": "undetected",
            "result": "unrated"
        },
        "Quick Heal": {
            "method": "blacklist",
            "engine_name": "Quick Heal",
            "category": "harmless",
            "result": "clean"
        },
        "Quttera": {
            "method": "blacklist",
            "engine_name": "Quttera",
            "category": "harmless",
            "result": "clean"
        },
        "SafeToOpen": {
            "method": "blacklist",
            "engine_name": "SafeToOpen",
            "category": "undetected",
            "result": "unrated"
        },
        "Sansec eComscan": {
            "method": "blacklist",
            "engine_name": "Sansec eComscan",
            "category": "undetected",
            "result": "unrated"
        },
        "Scantitan": {
            "method": "blacklist",
            "engine_name": "Scantitan",
            "category": "harmless",
            "result": "clean"
        },
        "SCUMWARE.org": {
            "method": "blacklist",
            "engine_name": "SCUMWARE.org",
            "category": "harmless",
            "result": "clean"
        },
        "Seclookup": {
            "method": "blacklist",
            "engine_name": "Seclookup",
            "category": "malicious",
            "result": "malicious"
        },
        "SecureBrain": {
            "method": "blacklist",
            "engine_name": "SecureBrain",
            "category": "undetected",
            "result": "unrated"
        },
        "SOCRadar": {
            "method": "blacklist",
            "engine_name": "SOCRadar",
            "category": "suspicious",
            "result": "suspicious"
        },
        "Sophos": {
            "method": "blacklist",
            "engine_name": "Sophos",
            "category": "malicious",
            "result": "phishing"
        },
        "StopForumSpam": {
            "method": "blacklist",
            "engine_name": "StopForumSpam",
            "category": "harmless",
            "result": "clean"
        },
        "Sucuri SiteCheck": {
            "method": "blacklist",
            "engine_name": "Sucuri SiteCheck",
            "category": "harmless",
            "result": "clean"
        },
        "Synthient": {
            "method": "blacklist",
            "engine_name": "Synthient",
            "category": "undetected",
            "result": "unrated"
        },
        "ThreatHive": {
            "method": "blacklist",
            "engine_name": "ThreatHive",
            "category": "harmless",
            "result": "clean"
        },
        "URLhaus": {
            "method": "blacklist",
            "engine_name": "URLhaus",
            "category": "harmless",
            "result": "clean"
        },
        "URLQuery": {
            "method": "blacklist",
            "engine_name": "URLQuery",
            "category": "undetected",
            "result": "unrated"
        },
        "Viettel Threat Intelligence": {
            "method": "blacklist",
            "engine_name": "Viettel Threat Intelligence",
            "category": "harmless",
            "result": "clean"
        },
        "VIPRE": {
            "method": "blacklist",
            "engine_name": "VIPRE",
            "category": "malicious",
            "result": "phishing"
        },
        "VX Vault": {
            "method": "blacklist",
            "engine_name": "VX Vault",
            "category": "harmless",
            "result": "clean"
        },
        "ViriBack": {
            "method": "blacklist",
            "engine_name": "ViriBack",
            "category": "harmless",
            "result": "clean"
        },
        "Webroot": {
            "method": "blacklist",
            "engine_name": "Webroot",
            "category": "harmless",
            "result": "clean"
        },
        "Yandex Safebrowsing": {
            "method": "blacklist",
            "engine_name": "Yandex Safebrowsing",
            "category": "harmless",
            "result": "clean"
        },
        "ZeroCERT": {
            "method": "blacklist",
            "engine_name": "ZeroCERT",
            "category": "harmless",
            "result": "clean"
        },
        "desenmascara.me": {
            "method": "blacklist",
            "engine_name": "desenmascara.me",
            "category": "harmless",
            "result": "clean"
        },
        "Xcitium Verdict Cloud": {
            "method": "blacklist",
            "engine_name": "Xcitium Verdict Cloud",
            "category": "harmless",
            "result": "clean"
        },
        "ZeroFox": {
            "method": "blacklist",
            "engine_name": "ZeroFox",
            "category": "undetected",
            "result": "unrated"
        }
    },
    "tags": [],
    "total_votes": {
        "harmless": 2,
        "malicious": 0
    }
}

How this compares to trusted websites

Trusted websites usually use a valid SSL certificate and keep it renewed.
They often have clear contact details, company information, privacy terms and refund policies.
They rarely appear on malware, phishing or abuse intelligence lists.
They use stable DNS, email authentication and predictable redirects.

Sources checked

VirusTotal Google Safe Browsing URLHaus OpenPhish PhishTank AlienVault OTX AbuseIPDB WHOIS DNS SSL Security headers Tranco

Technical safety checks

These checks explain the underlying signals behind the verdict. They are useful when you want to know whether a website has a stable domain history, a valid SSL certificate, normal DNS records and expected security configuration.

Domain information

Domain: paypa1.com
Registrar: MarkMonitor Inc.
Domain age: 9510 days
Created: 2000-10-20T23:17:07+00:00
WHOIS privacy: Yes

SSL details

Valid SSL: No
Issuer: No data available
Subject: No data available
Expires: No data available
Days remaining: No data available

HTTP checks

HTTPS available: No
HTTP available: Yes
Status code: 200
Final URL: https://www.paypal.com/nl/home
Page title: Geld overmaken, winkelen, betalingen beheren en nog veel meer | PayPal NL

DNS records

A records: 3.33.139.32
MX records: 1 bh.markmonitor.com
Nameservers: ns1.markmonitor.com, ns2.markmonitor.com, ns3.markmonitor.com, ns4.markmonitor.com, ns5.markmonitor.com, ns6.markmonitor.com, ns7.markmonitor.com
SPF record: v=spf1 -all
DMARC record: v=DMARC1; p=reject; rua=mailto:d@rua.agari.com; ruf=mailto:d@ruf.agari.com

Security headers

Present: content-security-policy, strict-transport-security, x-content-type-options, permissions-policy
Missing: x-frame-options, referrer-policy

Blacklist overview

VirusTotal malicious: 11
Google Safe Browsing unsafe: No
URLHaus listed: No data available
OpenPhish listed: No
PhishTank listed: No data available

Technical analysis

IP address: 3.33.139.32
ASN / organization: AS16509 Amazon.com, Inc.
Hosting provider: AS16509 Amazon.com, Inc.
Location: Seattle, Washington, US
High entropy score: 1.918
Suspicious TLD: No
Suspicious keywords: No data available

Redirect chain

http://paypa1.com/
https://www.paypal.com/

paypa1.com safety FAQ

Is paypa1.com a scam?

This automated report cannot make a legal accusation. It gives paypa1.com a trust score of 39/100 based on the security and reputation signals available at scan time. Review the warnings, threat detections and technical checks above before using the site.

Why did paypa1.com get this trust score?

The score is weighted from multiple signals, including threat-list matches, domain age, SSL status, redirects, DNS records, SPF/DMARC, security headers, suspicious keywords, IP reputation and popularity data.

Should I enter personal or payment information?

Do not enter payment details, passwords or personal information unless you can verify the website through an official source.

How often is this analysis updated?

The report is generated from stored scan data. When the automation script refreshes the domain, the page updates the score, threat intelligence, technical checks and popularity history.