4 ms·

Paypal-communications.com is a lookalike phishing domain, true or false? I don't think these companies understand the DNS system and purpose.

by _8j50 4y ago

formerly_proven 4y ago
You generally can't know if a mail is actually from Paypal or not, because they use a huge number of domains to send mails. Just assume everything that says it's from Paypal is fake, much easier.
- _8j50 4y ago
  Pretty much my point, how not using subdomains meant it is very difficult to stop phishing from look alikes.
jedberg 4y ago
I used to work in PayPal's anti-phishing group. In fact I was the first engineer on that group. We definitely understood DNS then. We even helped spearhead SPF and DKIM. And we strongly advocated that emails from the company never come from any domain other than PayPal.com Unfortunately after eBay bought PayPal, they put MBAs in charge, and the marketing team won every argument about the "necessity" of alternate domains to track marketing initiatives. They never really took into account the lost reputation of users getting constantly phished.
- _8j50 4y ago
  Thanks for that insight. Curious though, why did they not use a subdomain? Would communications. Or paypal-communications. As a subdomain be worse in their opinion?
  - jedberg 4y ago
    I'm not really sure. Probably something about tools not respecting or ignoring them or "they don't look as nice" or some other silly reason. Edit: To clarify, there were a lot of good reasons not to allow them to link to a subdomain, especially they were running marketing software made by other companies, because there is a lot of nasty security issues around cookies with subdomains. But there was no reason for them not to route their outbound email through a single domain, because the weren't supposed to run 3rd party mailers without deep audits.
  - bombcar 4y ago
    Some of the "subcontracted" sites that do marketing stuff are better equipped to handle a top-level domain than a subdomain. And a subdomain requires negotiating with someone in the bowels of IT, whereas anyone can register PayPal-communications.com
    - bad416f1f5a2 4y ago
      Oh man, this is been my exact experience. You can pretty much chart the growth of a company by watching how much marketing is done with in house teams and how much goes to external agencies. And as soon as the external agencies are involved, they want as much control as possible. I don’t blame them: setting up DNS entries for some stupid marketing site rarely rises to anyones priorities. So they route around internal controls. Everyone is happier, and everything gets slightly worse.
      - bombcar 4y ago
        I've yet to see someone be able to handle a delegated subdomain (where you set subdomain.example.com to have NS pointing at the contractor's setup). Too bad, as it's exactly what it was designed for.
        ceejayoz 4y ago
        We try to get our enterprise clients to delegate a subdomain to us; the answer is almost always no. "You'd be able to change the records! Oh sure, we can do a CNAME." Sigh.
justusthane 4y ago
CIBC sends sensitive emails from "cibc-clientaccountmanagement.com", with an SMTP mail from address of "test@emailservice-inbound-us-prod.adeptra.net" and broken SPF records. Edit: Is there a website to name-and-shame big companies who screw up SPF/DKIM/DMARC?

Paypal-communications.com is a lookalike phishing domain, true or false? I don't think these companies understand the DNS system and purpose.

by _8j50 4y ago

Paypal-communications.com is a lookalike phishing domain, true or false? I don't think these companies understand the DNS system and purpose.

formerly_proven 4y ago

You generally can't know if a mail is actually from Paypal or not, because they use a huge number of domains to send mails. Just assume everything that says it's from Paypal is fake, much easier.

_8j50 4y ago
Pretty much my point, how not using subdomains meant it is very difficult to stop phishing from look alikes.

jedberg 4y ago

I used to work in PayPal's anti-phishing group. In fact I was the first engineer on that group. We definitely understood DNS then. We even helped spearhead SPF and DKIM. And we strongly advocated that emails from the company never come from any domain other than PayPal.com Unfortunately after eBay bought PayPal, they put MBAs in charge, and the marketing team won every argument about the "necessity" of alternate domains to track marketing initiatives. They never really took into account the lost reputation of users getting constantly phished.

_8j50 4y ago
Thanks for that insight. Curious though, why did they not use a subdomain? Would communications. Or paypal-communications. As a subdomain be worse in their opinion?
- jedberg 4y ago
  I'm not really sure. Probably something about tools not respecting or ignoring them or "they don't look as nice" or some other silly reason. Edit: To clarify, there were a lot of good reasons not to allow them to link to a subdomain, especially they were running marketing software made by other companies, because there is a lot of nasty security issues around cookies with subdomains. But there was no reason for them not to route their outbound email through a single domain, because the weren't supposed to run 3rd party mailers without deep audits.
- bombcar 4y ago
  Some of the "subcontracted" sites that do marketing stuff are better equipped to handle a top-level domain than a subdomain. And a subdomain requires negotiating with someone in the bowels of IT, whereas anyone can register PayPal-communications.com
  - bad416f1f5a2 4y ago
    Oh man, this is been my exact experience. You can pretty much chart the growth of a company by watching how much marketing is done with in house teams and how much goes to external agencies. And as soon as the external agencies are involved, they want as much control as possible. I don’t blame them: setting up DNS entries for some stupid marketing site rarely rises to anyones priorities. So they route around internal controls. Everyone is happier, and everything gets slightly worse.
    - bombcar 4y ago
      I've yet to see someone be able to handle a delegated subdomain (where you set subdomain.example.com to have NS pointing at the contractor's setup). Too bad, as it's exactly what it was designed for.
      - ceejayoz 4y ago
        We try to get our enterprise clients to delegate a subdomain to us; the answer is almost always no. "You'd be able to change the records! Oh sure, we can do a CNAME." Sigh.

justusthane 4y ago

CIBC sends sensitive emails from "cibc-clientaccountmanagement.com", with an SMTP mail from address of "test@emailservice-inbound-us-prod.adeptra.net" and broken SPF records. Edit: Is there a website to name-and-shame big companies who screw up SPF/DKIM/DMARC?