The letters are checked
The address is decoded from punycode and folded down to latin letters. Here the fake a gives itself away, and the domain turns out to be xn--pypal-4ve.com.
How it works
pаypal.com/account/confirm
Confirm your account
Your account has been temporarily limited. Confirm your details within 24 hours to avoid closure.
Confirm now
ScamZam
pаypal.com
ScamZam this site
Checks the domain's age, the blocklists and the page itself, and explains the risk in plain language.
Looking the domain up in registries and blocklists…
HIGH RISK
12 days
Domain age
1/6
Blocklists
97%
Certainty
The address is written with letters that only look like the real ones. It says paypal.com, but it is not
The domain was registered 12 days ago
The site is on a public phishing blocklist
Read more
- Website
- xn--pypal-4ve.com
- Shown as
- pаypal.com
- Registered
- 18 August 2026
- Registrar
- NiceNIC International
- Hosting
- Stark Industries
- Server country
- Moldova
- Mail server
- No
- Certificate
- Let’s Encrypt, 11 days old
- Blocklist
- OpenPhish
9 checks left today
History
- You are on a page you are unsure about, and you click ScamZam in the toolbar
- You press the button, and it looks the domain up
- You get a verdict and the three most important reasons
- To see the figures behind it, you open the full report
What happens in those eight seconds
While you wait, about fifteen lookups are made. Not one of them with us.
1. The address is cut down
In your own browser, before anything is sent
pаypal.com/account/confirm becomes pаypal.com. We only look the domain up, and the path and parameters are exactly where personal details hide. At the same time, email addresses, phone numbers and long strings of digits are stripped from the text that is sent along.
The registry is asked
RDAP or WHOIS straight to the registry that owns the suffix. The answer here is the registration date, and that is the strongest single signal we have.
The blocklists are searched
over 218,000 known scam domains, refreshed every six hours. A hit settles the matter immediately.
The network is mapped
Who hosts the site, in which country, whether the domain has a mail server, and how old the certificates are.
The text is read
Two language models read the page for time pressure, unrealistic offers and machine translated language. If they disagree, a third is asked.
The answer is put together
The rules and the models are weighed against each other by fixed thresholds. The models can adjust the answer, but they cannot clear a site that is on a blocklist.