Whois says it's owned by Paypal on MarkMonitor, but that can be faked, right? Or does MarkMonitor require email address validation? (hostmaster@paypal.com in this case)
Correct. But even if the whois wasn't fakeable, do I really need to run a whois before I click on a link in an email?
Almost like we need an ssl-like authority for email now. Ugh.
MarkMonitor specifically is pretty picky about only taking on large-scale corporations (google.com, amazon.com, microsoft.com to name a few) so just the fact that it's registered there is usually a reliable way to confirm legitimacy, but checking whois is still way more research than an average PayPal user should need to do to avoid being phished.