Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

This has all traits of phishing, apart from the extended validation SSL cert. Is this site run by the real PayPal?

enter image description here

share|improve this question
add comment

3 Answers

I'm going to go ahead and say the unexpected - it looks legitimate to me actually.

A quick whois on the domain shows that the same DNS servers serve paypal-deutschland.de as paypal.com (as well as the registration information being almost identical in every other way) - this, in addition to an SSL Cert from VeriSign would be quite difficult to fake. The SSL Certificate being issued from Singapore looks suspect, I will admit, however it appears as though this exact matter was discussed in This German Forum.

That said, if you wanted to be 100% sure you could always contact PayPal support.

share|improve this answer
3  
I've also seen paypal.com redirect me to paypal-business.co.uk, which gave me quite a shock a few times. It's like they're trying to look like a fake... –  romkyns Jul 5 '12 at 20:13
3  
Same goes with their shady emails. They dont look legit at all.... pretty much fail all over the place! –  Chris Andrè Dale Jul 5 '12 at 20:39
    
Singapore, SG means the company is based in Singapore, not the cert was issued from Singapore. PayPal Private Ltd. is really located in Singapore. –  MV. Jul 6 '12 at 1:59
add comment

I believe it is legitimate. If you visit paypal.com, switch to the "Germany - Deutsch" site and check out the links on the resulting site, you can see that, for example, the "Sicherheit" (Google translate as "Security") link points to https://www.paypal-deutschland.de/sicherheit/.

Of course, one could argue that this means very little.

If in doubt, visit paypal.com and use the designated German site which appears to remain on the paypal.com main domain.

share|improve this answer
add comment

Only trusting the CA that this page is legitimate may not be the best solutions.

I fired up Google and looked at the site from that perspective:

Links going into suspsected phising site from paypal.com:

link:www.paypal-deutschland.de -site:www.paypal-deutschland.de SITE:paypal.com

About 3,930,000 results. I verified several of them, and Paypal.com is infact linking directly to the suspected phising site.

With that I would trust this site a whole lot more. Not only is a trusted CA telling you that this is Paypal's company, but Paypal is also telling you that this is their site. Unless the attackers has managed to compromise Paypal.com's sourcecode via injection or some other vulnerability it is very likely that this site is safe.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.