paypaynejp781.replit.app
Category: Phishing
To use full-featured product, you have to purchase a license for Combo Cleaner. Limited seven days free trial available. Combo Cleaner is owned and operated by RCS LT, the parent company of PCRisk.com.
Description of paypaynejp781.replit.app
This domain appears to host a page themed around PayPay, a Japanese digital payments and mobile wallet brand. The page title, visible branding, and Japanese-language interface suggest it is presenting a money-receipt or transfer claim screen, including a displayed amount and buttons for account registration or login.
However, the site is not hosted on PayPay's primary domain. Instead, it is served from a subdomain of replit.app, which is a general-purpose hosting platform commonly used for user-created web apps and temporary deployments. Based on the domain structure and page content, this page appears to imitate a payment-receipt workflow associated with the PayPay brand rather than representing an official corporate web property.
Safety Assessment for paypaynejp781.replit.app
Multiple scan signals indicate elevated risk at the time of this scan. The domain was flagged by 21 out of 91 security engines, and it was also listed by major threat databases for phishing or social-engineering activity. In addition, the screenshot shows PayPay branding on a replit.app subdomain rather than an official PayPay-owned domain, which closely suggests brand imitation and a possible credential-harvesting setup.
The page content itself raises further concern: it presents a large payment amount and prompts the visitor to either register or log in to receive funds, a pattern commonly associated with phishing lures. While one malware scan reported no directly flagged files and only generic suspicious-object heuristics on linked resources, that cleaner result is outweighed here by the broad multi-engine phishing consensus and the threat-database listings.
Based on these findings, this website may pose potential risks to visitors.
Technical Description
The site uses a valid TLS certificate issued by a mainstream certificate authority, with hosting on Google Cloud at IP address 34.117.33.233. The domain is a subdomain under replit.app, indicating deployment on a shared app-hosting platform rather than on infrastructure clearly associated with the imitated payment brand. DNSSEC appears to be unsigned.
From a security-review perspective, the main concern is not the certificate itself but the mismatch between the displayed PayPay branding and the non-official hosting/domain context. The scan data also references a login.php endpoint and multiple locally hosted assets flagged with generic suspicious heuristics, which may be consistent with a phishing kit or cloned front-end resources.
Share your experience with this website. Was it safe? Did you encounter any issues?