4 ms·

I don't get it either. <tangent> A few days ago, got a mail from PayPal about "changes in account". Go to my account was linked to https://www.secureserverpay

by avip 9y ago

I don't get it either. <tangent> A few days ago, got a mail from PayPal about "changes in account". Go to my account was linked to https://www.secureserverpaypal.ssvahan.com/home https://www.secureserverpaypal.ssvahan.com/home. I've forwarded the mail to PayPal spoofing address, they replied it's legit. Why would a legit PayPal activity be linked to an arbitrary domain - I don't get it. It makes zero sense.

brazzledazzle 9y ago
It sounds like your mailbox and/or client is compromised (that or someone is an idiot on paypal's end). I would assume you're totally compromised and start with a new computer that's installed with ISOs obtained from different computers/networks then change your passwords from there. There's probably guides you can follow online. But don't trust me, get the paypal phone number from the paypal site from somewhere like an Apple store or library and call them to ask about that URL yourself. The domain is not registered with the same provider and it's just super shady looking. Good luck.
- jwilk 9y ago
  Huh? How is receiving a phishing email an evidence of compromise?
  - monochromatic 9y ago
    Forwarding it to Paypal and getting a response that it's legit is certainly interesting.
    - avip 9y ago
      For the record, not overly happy with the response, I've sent this follow-up to spoof@paypal.com: >Hi there. Thanks for the quick response. I do have a question. Why would PayPal refer me to a form not hosted under PayPal domain? How can I tell it's a legit PayPal communication? Expectedly, never got a response.
      - brazzledazzle 9y ago
        Would it be possible for you to post the source (or even just the headers) with your email scrubbed from the message you received from them the first time? Depending on your email provider they could fake that too but it might be worth a look.
  - brazzledazzle 9y ago
    It seems very unlikely that PayPal's spoof email would validate an obviously spoofed domain. It could be that PayPal is completely phoning it in at this point but that's really egregious. Not that I think they're some amazing company, I'd even say they're downright evil based on past experiences.
unethical_ban 9y ago
That is not a legitimate website.
0x0 9y ago
Paypal support is useless at spotting fakes. I got a real paypal email (the received: headers and all embedded links pointed directly to paypal.com) but the email was not in my preferred language, and the disclaimer at the bottom said you can spot fake paypal emails by checking if they are in your preferred language. When I pointed this out, at first they claimed the email was fake. When I questioned them again and pointed to the received headers, they claimed the email was not fake and the language chosen was a bug. If paypal support can’t tell fakes from legit emails, how can regular users stand a chance at all!
exikyut 9y ago
As of 5 hours after writing your comment, I get NXDOMAIN here (Australia, FWIW). I would be confident to say that it was actively killed. Neat. Which is either a clear indication that PayPal finally did internally report the domain, or that some other source of noise got it shut down.

by avip 9y ago

brazzledazzle 9y ago

It sounds like your mailbox and/or client is compromised (that or someone is an idiot on paypal's end). I would assume you're totally compromised and start with a new computer that's installed with ISOs obtained from different computers/networks then change your passwords from there. There's probably guides you can follow online. But don't trust me, get the paypal phone number from the paypal site from somewhere like an Apple store or library and call them to ask about that URL yourself. The domain is not registered with the same provider and it's just super shady looking. Good luck.

jwilk 9y ago
Huh? How is receiving a phishing email an evidence of compromise?
- monochromatic 9y ago
  Forwarding it to Paypal and getting a response that it's legit is certainly interesting.
  - avip 9y ago
    For the record, not overly happy with the response, I've sent this follow-up to spoof@paypal.com: >Hi there. Thanks for the quick response. I do have a question. Why would PayPal refer me to a form not hosted under PayPal domain? How can I tell it's a legit PayPal communication? Expectedly, never got a response.
    - brazzledazzle 9y ago
      Would it be possible for you to post the source (or even just the headers) with your email scrubbed from the message you received from them the first time? Depending on your email provider they could fake that too but it might be worth a look.
- brazzledazzle 9y ago
  It seems very unlikely that PayPal's spoof email would validate an obviously spoofed domain. It could be that PayPal is completely phoning it in at this point but that's really egregious. Not that I think they're some amazing company, I'd even say they're downright evil based on past experiences.

unethical_ban 9y ago

That is not a legitimate website.

0x0 9y ago

Paypal support is useless at spotting fakes. I got a real paypal email (the received: headers and all embedded links pointed directly to paypal.com) but the email was not in my preferred language, and the disclaimer at the bottom said you can spot fake paypal emails by checking if they are in your preferred language. When I pointed this out, at first they claimed the email was fake. When I questioned them again and pointed to the received headers, they claimed the email was not fake and the language chosen was a bug. If paypal support can’t tell fakes from legit emails, how can regular users stand a chance at all!

exikyut 9y ago

As of 5 hours after writing your comment, I get NXDOMAIN here (Australia, FWIW). I would be confident to say that it was actively killed. Neat. Which is either a clear indication that PayPal finally did internally report the domain, or that some other source of noise got it shut down.