indicatorurl
hxxps://www[.]paypalrefund[.]workers[.]dev/en?utm_medium=chat&utm_campaign=link-shared-in-chat&utm_source=livechat.com&utm_content=direct.lc.chat
- First seen
- 2026-05-14
- Last seen
- 2026-05-14
- Sightings
- 1
Posts referencing this indicator
- LiveChat Abuse: How Phishers Are Exploiting SaaS Support Tools to Steal Sensitive Data
External phishing page hosted on Cloudflare Workers used to harvest PayPal credentials, billing info, and credit card details.