no you can't. Paypal is trademarked, and belong to a company, so you will never be able to buy it. If you do, you will probably going to get sued, if the name is such that users can confuse it with the current company.
Unless it is something like paypalsucks, which is totally legal.
Trademarks are not unique. They are unique within a given industry. And they may not be owned by the same party across different nations. This is already a problem with companies with the same name in different industries vying for the same URL.
Most phishers probably aren't going to have $50-100k spare either.
I think there has been a great misunderstanding with this scheme due to how its been reported by the likes of BBC News - applicants will have to submit business plans and demonstrate a technical capacity to maintain DNS servers - I bet they will have some pretty strict requirements by the time it's finalised, and I'm sure they will heavily scrutinise all applications.
It's not like any old Joe can just set up their own TLD overnight.
Yes, phishers probably aren't going to get TLDs due to cost (at least in the short term). But most companies that legitimately get TLDs will likely exercise as much oversight over subdomains as current .com registrars do -- that is, practically none at all.
While you won't be able to get the paypal TLD, I'd be surprised if paypal.shop is appreciably harder to get than paypalshop.com
