You are exactly right, not sure why you get down voted. Let's Encrypt does domain validation. It's perfectly fine that it issues a certificate to paypal.com.phi

You are exactly right, not sure why you get down voted. Let's Encrypt does domain validation. It's perfectly fine that it issues a certificate to paypal.com.phishysite.com to the rightful owner of phishysite.com. It's not their fault that some people do not grasp what that type of certificate (which is nothing new) assures and what not. If you really want blame someone you have to blame browser vendors for not making it clear enough inside their UI. //edit: Trademark protection gets even easier as CT logs present such potential violations on a silver plate.