Criticalscore 60 · flagged Tuesday, October 27, 2026

lecartomantidegliangeli.shop

Appeared in the .shop zone on Tuesday, October 27, 2026; by the end of that day the census found active website about e-commerce & retail. Full domain report

Signals, not verdicts. A domain appears here because heuristics matched its name, its infrastructure or the page it served on its first day. Where a model has looked at it, that is shown as an opinion with a confidence, not as a finding. Nothing on this page says a site is malicious. Read the evidence and decide for yourself.

Own one of these names and think the listing is wrong? Tell us and a person will look.

What matched

page impersonates a brand
matched: PayPal
+22
brand in page title, not in the name
matched: paypal
+20
form on a brand-styled page
matched: has_form
+18
Registrar
—
Nameserver provider
Nameservers
ns49.domaincontrol.com, ns50.domaincontrol.com
First-day state
active website
HTTP status
200
Page title
Shop Le Cartomanti degli Angeli – Box rituali, cristalli, pendoli e amuleti
Has a form
yes
Brand echoed
—

Model opinions

Second opinionlooks benignconfidence 80%· claude-opus-5-5

This is an Italian esoteric goods shop (ritual boxes, crystals, pendulums) under its own brand 'Le Cartomanti degli Angeli', linking to the matching lecartomantidegliangeli.com site. PayPal appears only as an accepted payment method, and the forms are add-to-cart and search, not credential capture, so the scorer's PayPal hit is a false positive.

First passlooks like phishingtarget: PayPalconfidence 92%· claude-haiku-4-5

Page impersonates PayPal by prominently displaying PayPal branding ('Pagamento sicuro con PayPal') and a login form ('Accedi') in the header, while the domain name and shop branding ('Le Cartomanti degli Angeli') are unrelated to PayPal. The form posts to self with hidden fields (csrf, azione, id_prodotto, quantita) in a sealed-room pattern typical of credential harvesting, and operator contact is via WhatsApp (+34 661 416 296), not PayPal support channels.

A model looked at the screenshot and page text and wrote what it thought. It can be wrong, and it is not a finding.

What the page looked like on Tuesday, October 27, 2026

Screenshot of lecartomantidegliangeli.shop taken by the zone census on 2026-10-27

Same data as JSON: /api/zone/domain/lecartomantidegliangeli.shop. This page is not indexed by search engines and does not link to the site it describes.