polipy[.]com

This domain is flagged as a high-risk brand impersonation threat targeting PayPal users. Analysis indicates the infrastructure is designed to harvest credentials through deceptive login portals, leveraging the legitimate PayPal brand identity to bypass user suspicion. The threat type is classified as credential theft via brand impersonation, with no evidence of crypto drainer or malware distribution at this time.

Infrastructure analysis reveals the domain polipy.com was registered on June 20, 2026, through NAMECHEAP INC. It currently resolves to IP address 172.67.145.29 and presents a page title identical to the legitimate PayPal service. VirusTotal reports 15 out of 95 security vendors have detected this domain as malicious, though no widespread blocklist adoption is yet observed. The SSL certificate is issued by Google Trust Services, providing a superficial layer of legitimacy to the fraudulent site. The domain remains active as of this report, with no signs of takedown or remediation.

Mitigation requires immediate action from security teams and end users. Network-level blocking of 172.67.145.29 and domain polipy.com is recommended for enterprise environments. End users should verify PayPal communications exclusively through official channels (paypal.com) and enable multi-factor authentication on financial accounts. Security teams should monitor for credential reuse attempts from harvested data, particularly targeting corporate or high-value accounts. Registrars and hosting providers should be notified of the fraudulent infrastructure for potential takedown procedures.