- I got an email this afternoon to my gmail from "firstname.lastname@example.org" with
signed-by: e.paypal.com. Gmail did not report it as spam/phishing/suspicious and it went straight to my inbox, so the MX records must check out.
- The email effectively linked to this url.
- The URL, when clicked, presents an HTTPS encrypted website bearing PayPal Inc's Class 3 EV certificate from Verisign, which is not easy to obtain.
By all accounts, it appears that the site is a legitimate PayPal property.
But then things start getting extremely suspect:
If you click "Continue" on that page, with or without entering any text in the email address field, it works -- it takes you to the "logged-in" site. Indeed, the "Log in" button at the top of the page turns to a "Log out" button. It's basically a smokescreen.
Then, immediately, you are greeted with a pane that displays cross-domain advertisements from other domains to try and get you to buy stuff. What in the world is the point of this website other than to display (possibly malicious / suspicious) third-party ads to get PayPal more money?
This makes absolutely no sense, and it really shakes my trust in PayPal as a company if they're willing to put their Class 3 EV cert on a site with this level of stupid. Also, the "AVAILABLE BY INVITATION ONLY" is completely a lie; you can go there on any computer in the entire world and click "Continue", and you're "in", for all that it's worth (which is, basically, nothing).
My concern is more that they implemented a website with such nonsense security; only sent out "invites" to certain users; and then had the gall to put their EV cert on it as if they endorse this hogwash. Why would a site go through the trouble of having an email "login" screen when what they want to do is to just display advertisements to anyone who's foolish enough to visit the site at all?