paypal.kinofino.de
Category: Phishing
- Don't sign in or pay here. Close it. If you typed a password, change it where you normally use it.
- Already visited? Check your device. A free scan shows whether anything was installed.
- Stop the next one. Combo Cleaner's web protection blocks phishing and scam sites before they load.
Combo Cleaner is PCrisk's own anti-malware tool, owned by RCS LT. Free to scan; removing what it finds needs a licence (7-day free trial).
Not checked: paypal.kinofino.de showed the file scanner only a script, not its page.
Description of paypal.kinofino.de
paypal.kinofino.de appears to be a subdomain under kinofino.de that uses the well-known "PayPal" brand name in its hostname. Based on the domain structure and the available categorization data, it does not appear to represent an official PayPal-owned domain. Multiple web-classification sources categorize it as phishing or fraud-related rather than as a legitimate payment or financial service portal.
The naming pattern suggests the page may be intended to resemble or imitate a PayPal-related login or payment page. There is no indication in the provided scan data that this subdomain belongs to PayPal or to an established financial institution. Based on the available information, the site appears to be a look-alike web property that may be used to capture user credentials or other sensitive information.
Safety Assessment for paypal.kinofino.de
The scan findings indicate substantial risk signals at the time of this scan. The domain was flagged by 24 security engines, and multiple web-classification providers labeled it as phishing or fraud-related. In addition, the hostname closely resembles paypal.com by placing the PayPal brand in a subdomain, which may indicate an attempt to look like a legitimate PayPal-related address. The lack of an established traffic ranking and the additional similarity warning further increase concern.
Blacklist and reputation data were mixed but still concerning. While some threat databases did not report the domain, one major browsing-protection source listed it, and the domain's IP address was also listed on one mail-reputation blocklist. A clean file-level malware scan does not outweigh the broader phishing indicators, especially because phishing pages often contain little or no malware payload. Based on these findings, this website may pose potential risks to visitors.
Technical Description
The site was reachable over HTTPS with a valid Let's Encrypt certificate, and the web server appears to be nginx hosted on infrastructure attributed to Kyonix Networks Limited in Frankfurt am Main, Germany. The presence of TLS may help encrypt traffic in transit, but it should not be treated as evidence of legitimacy because phishing sites commonly use valid certificates as well.
DNSSEC appears to be unsigned, which means DNS responses may not benefit from that additional integrity layer. The scan did not identify malicious files, external links, or iframes at the time of inspection, but that limited technical footprint is consistent with simple credential-harvesting pages as well as short-lived phishing setups.
Share your experience with this website. Was it safe? Did you encounter any issues?