The full anatomy of a phishing site,
one URL at a time.
ZeroPhish renders the page, runs twelve detection signals against the DOM, certificate chain, brand fingerprint and threat feeds, and returns a typed verdict. Built for security teams and product engineers.
No phishing signals detected
| URL | hxxps://www[.]paypal[.]com/ | |
| Host | www[.]paypal[.]com | |
| Registered domain | paypal[.]com | |
| Brand | PayPal | |
| Screenshot | https://cdn.zerophish.ai/03ac835d-c8a7-492a-8ee4-8ad3820884fc.jpg | |
| Scan ID | cd90fcad-ca80-40ad-8adc-24b99286e4b2 |
|
378 d ago
|
PHISHING | Paypal.com.secure-site.com | view → |
| Host | www.paypal.com |
| Registered domain | paypal.com |
| Scheme | https |
| Content length | 461537 B |
| HTTP | 200 · text/html |
| JARM | 7937937937937936029629626026024238c59ffd2d713659b02625529af55c |
| Redirect hops | 2 |
Page presentation
The page presents itself as the official PayPal US homepage (title: “Pay, Send and Save Money with PayPal | PayPal US”) and includes typical marketing sections like “Pay, send, and save smarter,” “Send,” “Split/Pool,” and “Pay in 4.”
Suspicious-element review (phishing signals)
- Credential collection form: Not observed in the provided HTML/OCR. The content appears to be promotional/informational; no password fields or login/checkout form elements are shown.
- Fake security/urgency warnings: No phrases like “account locked,” “suspicious activity,” “immediate action required,” or similar red-flag alerts appear in the provided text.
- Mismatched branding / deceptive domain signals: The URL is https://www.paypal.com/ and the page branding explicitly matches PayPal throughout. There are no signs of a lookalike domain, URL mismatch, or odd subdomain patterns.
- Suspicious redirects: No redirect behavior is indicated by the simplified HTML provided.
Brand/URL relationship
The identified brand is PayPal, and the page is served from paypal.com (the real primary domain). This alignment strongly argues against phishing.
Verdict
Given the correct first-party domain, consistent PayPal branding, and absence of any credential-harvesting UI or urgency-based social engineering in the provided material, this page is best classified as legitimate.