Apparently PayPal-affiliated site with very suspect security

Question

History

• I got an email this afternoon to my gmail from "[email protected]" with mailed-by: na.e.paypal.com and signed-by: e.paypal.com. Gmail did not report it as spam/phishing/suspicious and it went straight to my inbox, so the MX records must check out.
• The email effectively linked to this url.
• The URL, when clicked, presents an HTTPS encrypted website bearing PayPal Inc's Class 3 EV certificate from Verisign, which is not easy to obtain.

By all accounts, it appears that the site is a legitimate PayPal property.

But then things start getting extremely suspect:

• 

If you click "Continue" on that page, with or without entering any text in the email address field, it works -- it takes you to the "logged-in" site. Indeed, the "Log in" button at the top of the page turns to a "Log out" button. It's basically a smokescreen.

Then, immediately, you are greeted with a pane that displays cross-domain advertisements from other domains to try and get you to buy stuff. What in the world is the point of this website other than to display (possibly malicious / suspicious) third-party ads to get PayPal more money?

This makes absolutely no sense, and it really shakes my trust in PayPal as a company if they're willing to put their Class 3 EV cert on a site with this level of stupid. Also, the "AVAILABLE BY INVITATION ONLY" is completely a lie; you can go there on any computer in the entire world and click "Continue", and you're "in", for all that it's worth (which is, basically, nothing).

My concern is more that they implemented a website with such nonsense security; only sent out "invites" to certain users; and then had the gall to put their EV cert on it as if they endorse this hogwash. Why would a site go through the trouble of having an email "login" screen when what they want to do is to just display advertisements to anyone who's foolish enough to visit the site at all?

Answer 1

I have been doing further research, the special site has "PayPal, Inc[US]" certificate and the paypal original site has "PayPal, Inc.[US]" certificate (note the dot after Inc).

The certificates contain this (relevant) information:

CN = www.paypal-special.com
OU = Partner Support
O = PayPal, Inc
STREET = 2211 N 1st St
L = San Jose
S = California
PostalCode = 95131-2021
C = US
SERIALNUMBER = 3014267
2.5.4.15 = Private Organization
1.3.6.1.4.1.311.60.2.1.2 = Delaware
1.3.6.1.4.1.311.60.2.1.3 = US

CN = www.paypal.com
OU = PayPal Production
O = PayPal, Inc.
STREET = 2211 N 1st St
L = San Jose
S = California
PostalCode = 95131-2021
C = US
SERIALNUMBER = 3014267
2.5.4.15 = Private Organization
1.3.6.1.4.1.311.60.2.1.2 = Delaware
1.3.6.1.4.1.311.60.2.1.3 = US

There is something strange here as well, both certificates have the same serial number.

But, this certificate is quite expensive for two years (3 000 dollars) so I suppose the page is legit but a bit abandoned and they have not put enough effort in it.

Also, about the domain information, we can find the following data (which is consistant with the certificate information):

Domain Name: paypal-special.com
Registry Domain ID: 
Registrar WHOIS Server: whois.markmonitor.com
Registrar URL: http://www.markmonitor.com
Updated Date: 2013-12-23T04:01:12-0800
Creation Date: 2013-10-23T16:12:23-0700
Registrar Registration Expiration Date: 2015-10-23T16:12:24-0700
Registrar: MarkMonitor, Inc.
Registrar IANA ID: 292
Registrar Abuse Contact Email: 
Registrar Abuse Contact Phone: +1.2083895740
Domain Status: clientUpdateProhibited
Domain Status: clientTransferProhibited
Domain Status: clientDeleteProhibited
Registry Registrant ID: 
Registrant Name: Host Master
Registrant Organization: PayPal Inc.
Registrant Street: 2065 Hamilton Avenue, 
Registrant City: San Jose
Registrant State/Province: CA
Registrant Postal Code: 95125
Registrant Country: US
Registrant Phone: +1.4083767400
Registrant Phone Ext: 
Registrant Fax: 
Registrant Fax Ext: 
Registrant Email: 
Registry Admin ID: 
Admin Name: Domain Administrator
Admin Organization: eBay Inc.
Admin Street: 2145 Hamilton Avenue
Admin City: San Jose
Admin State/Province: CA
Admin Postal Code: 95125
Admin Country: US
Admin Phone: +1.4083767400
Admin Phone Ext: 
Admin Fax: +1.4083767514
Admin Fax Ext: 
Admin Email: 
Registry Tech ID: 
Tech Name: Host Master
Tech Organization: PayPal Inc.
Tech Street: 2211 North First Street
Tech City: San Jose
Tech State/Province: CA
Tech Postal Code: 95131
Tech Country: US
Tech Phone: +1.4083767400
Tech Phone Ext: 
Tech Fax: 
Tech Fax Ext: 
Tech Email: 

Answer 2

I often hear talk of "security theatre" – things that companies and organizations do to make people feel more secure without actually making them be more secure. The "security" on this site sounds a lot like that.

Unlike aeroplanes, however, this site doesn't actually need to be secure. It doesn't collect your PayPal password, it doesn't handle payments. All it does is provide advertising links and (presumably) set a few referrer cookies. It's not even on the regular PayPal domain.

The "security" here is simply because people expect to have a secure connection to PayPal. It's marketing, not actual security. PayPal haven't invested the money in making it actually secure because there's no reason to do so.

(Of course, the marketing may well have failed here because the "security" was too obviously theatre once you look below the surface, but that's still a marketing failure rather than a security failure.)

See also xkcd on the CIA website being hacked in 2011 – it's not concerning because the server that got hacked is simply not a server that needed to be particularly secure.

Answer 3

I got yeasterday e-mail from [email protected] and because I thought it maybe is not from PayPal I forwarded it to [email protected]. They answered me: "Hello Anne Palokangas, Thanks for forwarding that suspicious-looking email. You're right - it was a phishing attempt, and we're working on stopping the fraud. By reporting the problem, you've made a difference! Identity thieves try to trick you into revealing your password or other personal information through phishing emails and fake websites. To learn more about online safety, click "Security Center" on any PayPal webpage. Every email counts. When you forward suspicious-looking emails to [email protected], you help keep yourself and others safe from identity theft."