com-paypbm[.]vip

PhishDestroy identifies com-paypbm.vip as a high-risk phishing domain specifically engineered to impersonate PayPal’s payment portal. This fraudulent site employs credential harvesting tactics to deceive users into surrendering login credentials, financial details, and personal information under the guise of legitimate PayPal transactions. The threat is classified as a targeted payment phishing scam, designed to exploit trust in PayPal’s brand for financial fraud and identity theft. This domain was flagged by 16 out of 95 security vendors on VirusTotal, indicating widespread detection as malicious. It resolves to the IP address 104.21.53.109, a hosting provider frequently abused by phishing campaigns. The domain was registered through Gname.com Pte. Ltd., a registrar commonly associated with newly created fraudulent sites. Google Safe Browsing has explicitly labeled com-paypbm.vip as a phishing threat, further confirming its malicious intent. The domain’s recent creation date and use of a deceptive subdomain structure (com-paypbm) align with typical phishing domain characteristics, enhancing its ability to evade casual detection. Users who may have interacted with com-paypbm.vip should immediately change their PayPal passwords and enable two-factor authentication (2FA) to prevent unauthorized access. Financial institutions should be notified if any payment details were entered on the site. To avoid similar threats, users should verify the URL in their browser’s address bar before entering credentials, look for HTTPS encryption, and avoid clicking on links in unsolicited emails or messages. Organizations are advised to block the domain and its associated IP (104.21.53.109) at the network level to prevent internal access. Regular security awareness training can help users recognize phishing tactics, such as spoofed payment pages and urgent requests for sensitive information.