paypal[.]dalmatas[.]cl

This domain, paypal.dalmatas.cl, presents a direct threat as a brand impersonation phishing site targeting PayPal users. The infrastructure is designed to mimic legitimate PayPal login pages, tricking victims into entering their credentials, which are then captured by threat actors. The exposed directory listing (Index of /) suggests either misconfiguration or intentional exposure of backend files, increasing the risk of secondary payload delivery or further exploitation. Analysis indicates the domain is registered through NIC Chile and currently resolves to IP address 45.239.111.70, hosted on AS266855 (ECOHOSTING INTERNET LIMITADA) in Chile. Security vendors have flagged the domain with 14 detections out of 95 on VirusTotal, while Google Safe Browsing classifies it as phishing. The domain appears on two security blocklists (PhishDestroy and PhishingDB) and uses a Let's Encrypt SSL certificate (R13), a common tactic to lend false legitimacy to phishing sites. The combination of these indicators confirms the domain's malicious intent and active participation in credential theft campaigns. Users who visited paypal.dalmatas.cl should immediately revoke any entered credentials through PayPal's official account recovery process. Monitor financial accounts for unauthorized transactions and enable multi-factor authentication where available. Security teams should block the domain and IP (45.239.111.70) at the network perimeter, and investigate any internal connections to this infrastructure. The domain's current offline status does not eliminate risk, as threat actors may reactivate it or reuse the infrastructure for future campaigns.