GrizzlyGrizzly
Recent phishing
Phishing

Redirected from paypal.popid.com

Impersonating PayPal

Intent: Data collection

  • Domain is not operated by PayPal
  • DNS nameservers do not match PayPal's known infrastructure
  • TLS certificate has no organization information
  • Domain not registered through PayPal's usual registrar
  • SPF record does not reference PayPal's infrastructure

PopID account signup form collecting contact and identity information

Scanned 58 days ago · Aug 2, 2026, 21:41 UTC

Think this verdict is wrong?

Check a suspicious URL yourself — free to try.

Scan a URL
Phishing: paypal-webapp.sandbox.popid.com — Grizzly