Today I made an Ebay purchase. When authenticating to PayPal I was sent to companyfinder.xyz when using 18.104.22.168 as my dns server. This was with Warp one my pc, and with my router using 22.214.171.124 as it’s DNS server.
I scanned with MalwareBytes and offline scan with Windows Defender, neither found a problem.
I told my router to use DHCP to obtain DNS from my ISP, and had no problem connecting to PayPal.
Looking Companyfinder.xyz it appears cloudfare host a site called Companyfinder.club.
nslookup using my router dns
Looking up 126.96.36.199 result in Part of [AS13335 - Cloudflare, Inc.]