DOM XSS on PayPal's Main Domain
A payload placed in the URL fragment reached a DOM sink on PayPal's main domain and executed; PayPal closed the report as a duplicate.
URL fragment
Everything after the # never reaches the server. That is the whole point of putting the payload there.