payme-paypal[.]com

This domain, payme-paypal.com, is flagged as a high-risk brand impersonation threat targeting PayPal users. Analysis indicates the site presents a fraudulent payment request interface, as evidenced by the page title 'Zahlungsanfrage erhalten | PayPal,' which closely mimics legitimate PayPal communications. The domain is designed to deceive users into entering sensitive financial or login credentials, likely funneling them to a backend drainer kit or credential-harvesting system. No specific drainer kit has been attributed at this time, but the infrastructure aligns with known phishing campaigns impersonating financial services. Infrastructure analysis reveals multiple technical indicators of compromise. The domain was registered on June 26, 2026, through Cloudflare, Inc., and resolves to the IP address 188.114.96.3. VirusTotal reports 8 out of 95 security vendors flagging the domain as malicious, while the SSL certificate is issued by Google Trust Services, a common tactic to lend false legitimacy. The domain's creation date is unusually recent for a financial service, and its registration details are obscured by a privacy service, a frequent red flag in phishing operations. No Google Safe Browsing (GSB) hits are currently recorded, but the blocklist count remains significant given the low detection threshold. As of the latest assessment, payme-paypal.com remains active and poses an ongoing risk to users. Immediate response actions include reporting the domain to hosting providers, certificate authorities, and security blocklists to facilitate takedowns. Users are advised to avoid interacting with the site, verify payment requests directly through PayPal's official channels, and monitor accounts for unauthorized activity. Despite takedown efforts, the domain's infrastructure and low detection rate suggest it may persist or resurface under a different alias, necessitating continued vigilance and proactive threat intelligence sharing.