Phishing tracker @phishunt_io posted on X on 11 November 2026 that paypal[.]kinofino[.]de is a PayPal-themed phishing site, hosted at IP 150.241.66.223 on Kyonix Networks (AS210457) in Germany. The domain also appears…
Source: x.com · published
Phishing tracker @phishunt_io posted on X on 11 November 2026 that paypal[.]kinofino[.]de is a PayPal-themed phishing site, hosted at IP 150.241.66.223 on Kyonix Networks (AS210457) in Germany. The domain also appears on the Phishing Army extended blocklist, a public phishing domain blocklist. This host is not an official PayPal address, and PayPal is impersonated. Log in to PayPal only through the official app or by typing paypal.com yourself.
Pages that copy a familiar sign-in form are usually reached from an email, text, advert, comment or search result that warns of a problem with an account, a delivery or a payment. The form looks official, but anything typed — a password, a one-time code or a wallet recovery phrase — goes to whoever set up the page rather than to the real company. Those details can be used at once to take over the account, change the recovery email or empty a wallet.
paypal.kinofino.de is not an official PayPal address. PayPal was impersonated and is not involved. The host IP listed in the tracker post sits on Kyonix Networks address space in Germany; that is the infrastructure provider, not proof the page is safe. The domain also appears on the Phishing Army extended blocklist. Sign in to PayPal only through the official app or by typing paypal.com yourself.
PayPal will not ask you to sign in on a kinofino.de host to solve a problem or confirm a payment. If you already entered a password or a one-time code there, change it in the official app and review recent activity.
Public post on X, 11 November 2026: https://x.com/phishunt_io/status/2120502225977929765
The indicators come from this source and have not been independently checked by scammers.com.
Security researcher @KesaGataMe0 posted on X on 12 November 2026 that hxxps://smbc[.]hocxiu[.]com/ is a phishing site impersonating SMBC (Sumitomo Mitsui Banking Corporation, 三井住友銀行), served through Cloudflare (AS1333…
Security researcher @catnap707 posted on X on 12 November 2026 about fake websites (偽サイト) impersonating the Tokyo Metropolitan Police Department (警視庁). The post lists the links jp[.]kdfz[.]net, jp[.]kstw[.]net, jp[.]k…
PhishDestroy posted on Mastodon on 12 November 2026 that xncok12[.]weebly[.]com is a phishing page. Its record describes a GMX.NET-branded email and password login form, flagged by 17 of 92 VirusTotal engines. GMX is…
PhishDestroy posted on Mastodon on 12 November 2026 that xfinitywebmailw3r[.]weebly[.]com is a phishing page. Despite the Xfinity name in the address, its record describes a Network Solutions-branded webmail login for…
PhishDestroy posted on Mastodon on 12 November 2026 three Weebly-hosted pages it flagged as phishing: zimbfree[.]weebly[.]com, zimbrafree9[.]weebly[.]com and zim-update2025[.]weebly[.]com. Its records describe Zimbra-…
ScanMalware posted on X on 12 November 2026 that payee-security-online[.]web[.]app is a confirmed scam. Its scan report says the host matches an analyst-vetted UK bank account-recovery phishing kit impersonating Santa…