paypalsupport.pages.dev Safety Check — PayPal Brand Impersonation

This domain, paypalsupport.pages.dev, is flagged as a high-risk brand impersonation threat targeting PayPal users. Analysis indicates the infrastructure is designed to mimic official PayPal support pages, likely to harvest credentials or facilitate unauthorized transactions. The page title, pay.pal.support, reinforces the deception by closely resembling legitimate PayPal subdomains, increasing the likelihood of victim engagement. Infrastructure analysis reveals the domain resolves to the IP address 188.114.97.3, associated with Cloudflare, Inc. and located in Canada. The domain was registered on March 24, 2026, through Cloudflare’s registrar services. Security vendor assessments on VirusTotal report 11 detections out of 95, while the domain appears on one security blocklist. The SSL certificate is issued by Google Trust Services (WE1), a common feature in both legitimate and malicious Cloudflare-hosted pages. Google Safe Browsing does not currently list the domain, though this may reflect delayed detection rather than absence of threat. As of the latest verification, paypalsupport.pages.dev remains active, continuing to pose a risk to users who may mistake it for legitimate PayPal support. Response actions should include immediate reporting to hosting providers and certificate authorities to facilitate takedown. Organizations are advised to block the domain and associated IP at the network level, while end users should be cautioned against interacting with any unsolicited communications directing them to this infrastructure. The remaining risk is classified as high due to the domain’s active status and the potential for credential theft or financial fraud.