1

So I received an email from "paypal.com" yesterday (and looks like most people did too(1)) and I've verified the ascii letters are indeed what they appear as (No capital I instead of L in paypal.com etc).

The email looks like a very good attempt of being authentic and passes the tests that they teach most people on "how to detect a hoax email":

  • Addresses me in my full name
  • Good english
  • No fake links
  • No real links, i.e. asking me to go to paypal instead
  • No dangerous call to action
  • From address is from a domain paypal controls
  • Signed from a domain paypal controls

There are a few suspicious giveaways like the mailed-by address and if you dig in the header, the Return-Path and Receive sections are strange.

Question is how is it possible that they can send a digitally signed email from a domain paypal controls.

.enter image description here

Improve this question
6
  • 3
    It is hard to tell without seeing the actual, full and unchanged source code of the mail instead of the rendering in the mail application. In the reddit discussion you provide I've seen only a few lines like parts of the DKIM-Signature which are not really sufficient. You can get the source at "Show original" and then "Download original".
    – Steffen Ullrich
    Mar 17, 2018 at 7:06
  • Ctrl+U in Thunderbird so see full source
    – BlueWizard
    Mar 17, 2018 at 8:09
  • 1
    @BlueWizard: OP is obviously using the GMail web interface based on the image. This means recommendations for Thunderbird are not of much use.
    – Steffen Ullrich
    Mar 17, 2018 at 9:08
  • 3
    I am not convinced this is not legitimately from Paypal. Odd domains for tracking clicks and bounces are unfortunately not uncommon. Please check with Paypal whether this email is legitimate before posting a vague question about "some" signature being forged.
    – Luc
    Mar 18, 2018 at 0:37
  • 1
    Somebody on a paypal forum said that what looks rhe letter „L“ in the word „paypal“ seems to actually be a capital „i“. Could you check for this?
    – StackzOfZtuff
    Mar 20, 2018 at 22:36

2 Answers 2

Reset to default
2

This was a marketing message sent (and signed) on behalf of PayPal.
It is safe to click the unsubscribe link.

As captured by GMail's excellent summary view:

Google security summary

See the mailed-by section? mkt2944.com is a part of Silverpop, a Email Service Provider which was acquired by IBM in 2014 and was recently folded into IBM Watson Campaign Automation.

 

how is it possible that they can send a digitally signed email from a domain paypal controls?

It's not really possible, though there are some tricks that can make it seem valid (e.g. Mailsploit). In this case, it's not spoofed because they have permission. The server at bounce.paypal.mkt2944.com has a DKIM key that is hosted at some paypal.com domain as indicated by the DKIM selector (the s= part of the DKIM-Signature header, so if it were s=foo then the key would live as a TXT record at foo._domainkey.paypal.com).

Improve this answer
0

AFAIK all the text in email, including the hidden headers, are modified and passed on as the email goes from server to server, with no verification process. A header which says "sent by foobar, verified by mumble" is just text. There may be verifiable elements such as digital signatures in the email, but they have to be externally verified. A postcard that says "you won" means nothing until you successfully cash the check.

Improve this answer
2
  • and google doesn't verify the signed-by:paypal.com component of the email? I was sure it did and there was more to it.
    – James
    Mar 18, 2018 at 13:49
  • in the underlying email protocols, after some chitchat to make sure the servers want to talk to each other and deliver mail to a certain account, the rest is just to dump text to be delivered. It's not verified. Mail readers can do whatever they wish with the text, but there are no general protocols to verify any part of the content.
    – ddyer
    Mar 18, 2018 at 18:05

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .