verification-help[.]netlify[.]app

This domain, verification-help.netlify.app, is currently flagged as a PayPal brand impersonation used in an e‑commerce scam. VirusTotal analysis shows that 14 of 95 security vendors have marked the host as malicious, and the domain is listed on a single external blocklist that is actively enforced by PhishDestroy. Technical profiling indicates the site is hosted on Netlify infrastructure, with HSTS enabled, and it presents a DigiCert Global G2 TLS RSA SHA256 2020 CA1 certificate issued by DigiCert Inc. The HTTP response returns a 404 status and the page title is “Site not found,” confirming that the content has been taken offline. DNS resolution points to the IPv6 address 2a05:d014:58f:6200::259, which geolocates to Germany and is announced by AS16509 owned by Amazon.com, Inc. The registrar information shows the site was provisioned through Netlify; no custom nameservers are reported.

The risk level is elevated, reflecting the verified brand impersonation despite the current offline state. Evidence indicates the domain was used to mimic PayPal services, but no additional artifacts such as login forms or credential‑harvesting scripts have been captured. Consequently, the precise malicious payload and the timeline of active exploitation remain uncertain.

Defenders should continue to block the domain at network perimeters, update threat‑intel feeds with the observed indicators, and monitor the underlying Netlify hosting environment for re‑use of the same sub‑domain or similar patterns. Monitoring for re‑registration of the domain or the emergence of new Netlify‑hosted domains that reference PayPal is recommended. Because the SSL certificate is still valid, any future activation could inherit the existing trust chain, so early detection is critical.