Hacker News Reader

Comment by avip | Hacker News Reader

I don't get it either.

A few days ago, got a mail from PayPal about "changes in account". Go to my account was linked to https://www.secureserverpaypal.ssvahan.com/home. I've forwarded the mail to PayPal spoofing address, they replied it's legit. Why would a legit PayPal activity be linked to an arbitrary domain - I don't get it. It makes zero sense.

View on HN

It sounds like your mailbox and/or client is compromised (that or someone is an idiot on paypal's end). I would assume you're totally compromised and start with a new computer that's installed with ISOs obtained from different computers/networks then change your passwords from there. There's probably guides you can follow online. But don't trust me, get the paypal phone number from the paypal site from somewhere like an Apple store or library and call them to ask about that URL yourself. The domain is not registered with the same provider and it's just super shady looking. Good luck.

Huh? How is receiving a phishing email an evidence of compromise?

Forwarding it to Paypal and getting a response that it's legit is certainly interesting.

For the record, not overly happy with the response, I've sent this follow-up to spoof@paypal.com:

>Hi there. Thanks for the quick response. I do have a question. Why would PayPal refer me to a form not hosted under PayPal domain? How can I tell it's a legit PayPal communication?

Expectedly, never got a response.

Would it be possible for you to post the source (or even just the headers) with your email scrubbed from the message you received from them the first time? Depending on your email provider they could fake that too but it might be worth a look.

It seems very unlikely that PayPal's spoof email would validate an obviously spoofed domain. It could be that PayPal is completely phoning it in at this point but that's really egregious. Not that I think they're some amazing company, I'd even say they're downright evil based on past experiences.

Paypal support is useless at spotting fakes. I got a real paypal email (the received: headers and all embedded links pointed directly to paypal.com) but the email was not in my preferred language, and the disclaimer at the bottom said you can spot fake paypal emails by checking if they are in your preferred language. When I pointed this out, at first they claimed the email was fake. When I questioned them again and pointed to the received headers, they claimed the email was not fake and the language chosen was a bug. If paypal support can’t tell fakes from legit emails, how can regular users stand a chance at all!

That is not a legitimate website.

As of 5 hours after writing your comment, I get NXDOMAIN here (Australia, FWIW).

I would be confident to say that it was actively killed. Neat. Which is either a clear indication that PayPal finally did internally report the domain, or that some other source of noise got it shut down.

Reply on news.ycombinator.com