paypromiseland[.]com

Analysis of the domain paypromiseland.com confirms its classification as an active phishing site targeting users through an estate-themed lure. Registered on May 12, 2026, via OwnRegistrar, Inc., the domain resolves to the IP address 209.209.40.72, which is hosted by Cloud Clusters Inc. in the United States. The nameservers ns1.cloudclusters.net and ns2.cloudclusters.net further tie the infrastructure to this provider, a pattern observed in other recently documented phishing campaigns. The site presents itself with the page title 'PromiseLand - Estate,' suggesting an attempt to impersonate a legitimate real estate or financial service platform to deceive visitors. Infrastructure review reveals the use of a Let's Encrypt SSL certificate (R13), which provides HTTPS encryption but does not validate the legitimacy of the site’s content. The domain has been flagged by two out of ninety-five security vendors on VirusTotal, indicating limited but present detection. Additionally, the domain appears in one AlienVault OTX threat intelligence pulse and is blocked by at least one security blocklist, reinforcing its malicious classification. The HTTP status code 200 confirms the site is currently operational and serving content, increasing the urgency for mitigation. While the exact phishing kit or targeted brand remains unconfirmed, the combination of a recently registered domain, estate-themed branding, and hosting on a provider frequently associated with malicious activity aligns with known phishing tactics. Defenders should prioritize blocking the domain and its resolving IP address at the network level. Security teams are advised to monitor for related domains registered through OwnRegistrar, Inc., particularly those using Cloud Clusters Inc. infrastructure, as this may indicate a broader campaign. End-users should be alerted to the risks of interacting with unsolicited real estate or financial offers, especially those originating from newly created domains.