resources[.]paypalgivingfund[.]ca

The domain resources.paypalgivingfund.ca was first observed on March 27 2026 and is currently classified as a brand‑impersonation campaign targeting PayPal. The site presents the page title “Resources and News | PayPal CA” and returns an HTTP 301 response, suggesting a temporary redirect to a possibly malicious landing page.

Registration data shows the domain was acquired through MarkMonitor International Canada Ltd., a registrar commonly used for legitimate brand domains. DNS is served by the nsone.net pool (dns1‑dns4.p10.nsone.net). Resolving the name yields the address 3.71.139.153, which belongs to an AWS EC2 instance in the eu‑central‑1 region (Germany). The TLS certificate is issued by Let’s Encrypt (identifier E8), a free service that does not convey any intrinsic trust.

Reputation signals are poor: Gridinsoft assigns a trust score of 0 / 100 and the domain appears on one security blocklist. PhishDestroy has already listed the host as blocked. Despite a clean VirusTotal result (0 / 95 detections), the absence of detections does not confirm safety, especially given the active status and the payment‑scam classification. The exact malicious payload or phishing page content has not been publicly disclosed, leaving the full operational details uncertain.

Defenders should proactively block the hostname and the associated IP address at perimeter and endpoint layers. Continuous monitoring of DNS queries for the nsone.net name servers can help identify secondary infrastructure. User‑facing security awareness programs must reinforce that PayPal communications are delivered from official PayPal domains and never from URLs containing “paypalgivingfund”. Incident response teams should be prepared to capture any credential submissions that may be forwarded through this infrastructure.