secure-paypaI-login.com

Confirmed homograph attack — the second "l" is a capital I. Posting form sends credentials to a Russian VPS. Flagging as critical.

0x9F2c...A41b

This wallet just received funds from 3 victims in the last hour. On-chain trail leads to Tornado-style mixer. Everyone should block.

luxe-deals-outlet.shop

Ordered a "test" item 12 days ago, no shipping, support email bounces. Same template as last week’s flagged store.

support@netfllx-billing.com

Headers attached. SPF hard fail, domain age 4 days. Classic billing phish. Recommend verified status.