paylink-paypal[.]com

This domain is classified as a high-risk brand impersonation site specifically targeting PayPal users. Analysis indicates the infrastructure is designed for credential theft, leveraging the PayPal brand to deceive victims into submitting login credentials, financial details, or other sensitive information. The threat type is narrowly defined as brand impersonation with a focus on financial fraud, distinct from generic phishing or malware distribution. Infrastructure analysis reveals the domain paylink-paypal.com was registered on June 22, 2026, through Name.com, Inc., and currently resolves to IP address 64.29.17.65, hosted on Amazon.com, Inc. (AS16509). The site remains active and is flagged by 22 out of 95 security vendors on VirusTotal. It appears on three security blocklists and is explicitly blocked by PhishDestroy, OpenPhish, and Phishunt. The SSL certificate is issued by Let's Encrypt (YR1), a common tactic to lend false legitimacy to malicious domains. The domain's creation date is anomalously set in the future, a red flag for suspicious activity. Mitigation requires immediate blocking of the domain and its resolving IP (64.29.17.65) at the network perimeter. Organizations should deploy indicators of compromise (IOCs) including the domain, IP, and SSL certificate fingerprint to endpoint detection systems. User awareness training should emphasize the risks of brand impersonation, particularly for financial services, and instruct users to verify domain authenticity before entering credentials. Monitoring for similar domains (e.g., paypal-paylink.com variants) is recommended to preemptively disrupt related campaigns. Incident response teams should treat any interaction with this domain as a potential credential compromise and initiate password resets for affected accounts.