paypalllogin-d77aad[.]webflow[.]io

The domain paypalllogin-d77aad.webflow.io is identified as a brand impersonation threat specifically targeting PayPal. Analysis confirms this domain hosts a fraudulent login interface designed to harvest user credentials. Current status indicates the domain has been taken offline, though prior activity remains a documented security concern. Infrastructure analysis reveals the domain was flagged by 21 of 95 security vendors on VirusTotal, indicating moderate-to-high detection confidence. Registered through MarkMonitor, Inc., the domain was created on March 08, 2026, and resolves to the IP address 104.18.36.248, hosted on AS13335 (Cloudflare, Inc.). The SSL certificate is issued by Google Trust Services (WE1), and the domain appears on one security blocklist. The page title, 'PayPal Login | Fast way to get money | Zellepay Login,' explicitly references PayPal and Zelle, further confirming its intent to deceive users into entering sensitive financial information. Current status shows the domain is offline, reducing immediate risk. However, organizations and users should remain vigilant. Recommended actions include blocking the domain and associated IP (104.18.36.248) at the network perimeter, updating endpoint detection rules to flag similar impersonation patterns, and monitoring for credential reuse attempts. Users who may have interacted with this domain should reset their PayPal credentials immediately and enable multi-factor authentication. Security teams should correlate logs for connections to the domain or IP to identify potential compromise.