consumertestconnect[.]com

Consumertestconnect.com was observed on July 12, 2026 as an active brand‑impersonation campaign targeting PayPal users. The site presents a page titled “ConsumerTestConnect - Paypal” and mimics the visual layout of the legitimate PayPal checkout flow. The campaign is classified with a high risk level and is currently listed as active in threat‑intel feeds. Infrastructure analysis shows the domain was registered on March 06, 2026 through NameCheap, Inc. The authoritative name servers are ns-1338.awsdns-39.org, ns-1998.awsdns-57.co.uk, and ns-364.awsdns-45.com. DNS resolution points to IP address 100.30.61.232, which belongs to AS14618 Amazon.com, Inc., located in the United States. The site serves an SSL certificate issued by Amazon with the RSA 2048 M02 profile, indicating the use of a standard Amazon‑provided certificate. Detection metrics reveal limited but notable security vendor coverage: VirusTotal reports three of ninety‑five scanners flagging the domain, and Gridinsoft assigns a trust score of 1 out of 100. The domain appears on a single public blocklist and is actively blocked by PhishDestroy. HTTP response code 200 confirms that the server delivers content without redirection, consistent with a credential‑harvesting landing page. Defenders should add 100.30.61.232 to network blocklists and ensure that consumertestconnect.com is included in URL filtering rules. Continuous monitoring of NameCheap registrations for newly created domains referencing PayPal can provide early warning. Where possible, sinkholing the associated Amazon DNS zones or collaborating with the registrar to seize the domain may disrupt the campaign. End‑user education campaigns should emphasize verification of PayPal URLs and caution against unsolicited login prompts.