Ask HN: Scam from `service@paypal.com` email, How?
Sender IP and SPF: The SPF record indicates that the email was sent from IP 66.211.170.88 and that this IP is a designated sender for paypal.com. This is a good sign, as SPF is a method for domain owners to specify which IPs are allowed to send emails on their behalf. Still, this can be faked in phishing emails, so it isn't an absolute proof.
DKIM Signature: DKIM provides an encryption-based method to validate the authenticity and integrity of a message. The DKIM-Signature indicates that the email is signed and suggests it genuinely came from paypal.com with the signature being verified. This is another positive sign.
DMARC: The DMARC record shows a pass for the email. DMARC builds on SPF and DKIM to give receivers a way to improve and monitor the protection of the domain from fraudulent email. This is another good indication that the email is genuine.
Helo Record: The email identifies itself as coming from mx2.phx.paypal.com. Cross-referencing this with the IP 66.211.170.88 can give more information. Ideally, a DNS lookup on this domain should resolve to this IP, or vice versa. Authentication-Results: spf=pass (sender IP is 66.211.170.88)
smtp.mailfrom=paypal.com; dkim=pass (signature was verified)
header.d=paypal.com;dmarc=pass action=none
header.from=paypal.com;compauth=pass reason=100
Received-SPF: Pass (protection.outlook.com: domain of paypal.com designates
66.211.170.88 as permitted sender) receiver=protection.outlook.com;
client-ip=66.211.170.88; helo=mx2.phx.paypal.com; pr=C
Received: from mx2.phx.paypal.com (66.211.170.88) by
AM7EUR06FT065.mail.protection.outlook.com (10.233.255.252) with Microsoft
SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id
15.20.6723.11 via Frontend Transport; Mon, 21 Aug 2023 14:39:41 +0000
X-IncomingTopHeaderMarker:
OriginalChecksum:D3EF06AD4D210DE94DD4CEF7676ADB33FFADDA146826968760B256614DBA0BB3;UpperCasedChecksum:C166224836B8549C000E1248A8D0B21B268DA10BAE404535ECAE6D2AC1E4F7F4;SizeAsReceived:1198;Count:17
DKIM-Signature: v=1; a=rsa-sha256; d=paypal.com; s=pp-dkim1; c=relaxed/relaxed;
q=dns/txt; i=@paypal.com; t=1692628775;
h=From:From:Subject:Date:To:MIME-Version:Content-Type;
bh=y3PR47e+bNTQkjaVkSmH1awii6kjs/uhFtgV+UQXT64=;
b=Y75EdoYH0VTDJ+1oaj5hM8Ev5CFNJxLSoLPSF6ICH/o4WEEW1kKZUvQDi63VGPd5
LxThPfH3DOqpW/o/mi8AmnbRaSfuYR2vhSIVYMXghc0VQ4CKD9J06JjDN2IO5M7/
lfWDOrXZJEAbJcSr92SnOucKMwoDngZiB2gy7SJG17187W2zmGjqZAFzNton8ssu
3aM6RRfFS+JxDEpuX3XPxYzQQsczTy2Qn/L28Yl+cJ4/HaV7myzte2OGr0qi+cQw
UEyT8Gd345qdkpxBmBUAk9Tu/Wcb6gQUdm+cDymkdcnPsuOKuW6DBgj47c76Arxw
20exiKh305Upy67mHCHvAA==;
Content-Transfer-Encoding: quoted-printable
Content-Type: text/html; charset="UTF-8"
Date: Mon, 21 Aug 2023 07:39:35 -0700
Message-ID: <53.BB.28950.72773E46@ccg01mail04>
X-PP-REQUESTED-TIME: 1692628766599
X-PP-Email-transmission-Id: 8a9be26e-4030-11ee-bba5-40a6b729312c
PP-Correlation-Id: b2d6ca346679c
*Subject: Invoice from Marquis Pleasants (0084)*
X-MaxCode-Template: RT000238
To: <xxxxxxxxxxxxxxxxxxxxxxx>
From: "service@paypal.com" <service@paypal.com>
X-Email-Type-Id: RT000238
X-PP-Priority: 0-none-true
AMQ-Delivery-Message-Id: nullval
X-XPT-XSL-Name: nullval
X-IncomingHeaderCount: 17
....
X-Microsoft-Antispam: BCL:5;
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 21 Aug 2023 14:39:41.5613
(UTC)
...
X-Microsoft-Antispam-Mailbox-Delivery: