MeritBudi
Member OP
Got email from PayPal ask verify account already click or not can? Look real but URL weird lah. Anyone else get this dong?
Is anyone else getting weird PayPal verification emails?
Not a virtualization issue but relevant: check the headers. Real PayPal uses SPF/DKIM alignment. Phishing usually fails both. Virtualization tax applies to security awareness too.
Mark my words, this is a real security push executed by incompetent marketing drones. The phishing version appearing same week is not coincidence. Twenty years in this business, and the scammers still outpace the legitimate operators.
IPv4, IRC, and irssi — fight me
marcus_qc
Member
Hey folks we got 4 customers ask this already. Real email from PayPal but super weird timing. We posted warning on our status page. Almost fell for fake one myself fixed fast tho
42U and still growing
2001:0db8:0000:0000:0000:0000:0000:0001 received same email. Legacy IP users report more phishing. Dual-stack your email security. NAT of trust destroys address space integrity. PayPal should mandate IPv6-only verification, eliminate legacy IP attack surface entirely.
oops: 0000 [#1] SMP
The Email Headers show correct DKIM Signature yes but the Landing Page uses suspicious Subdomain no. PayPal Security Push is real yes but poorly executed yes. I checked the SPF Record and found Mismatch in include Mechanism. Always verify the Return Path.
The legitimate PayPal security push uses AS 17012 for outbound mail. Check the SMTP path against their published SPF record, which includes ip4:66.211.168.0/24 and others. The phishing variant I analyzed routes through a residential ASN in Eastern Europe with no PTR records and invalid RPKI. I reported both the hijacked prefix and the fraudulent route to the appropriate RIR and upstream transit providers. The IRR entries for the legitimate range are current in RADB under PPL-SPAM. Always verify origin AS, not just clickable links.
iBGP, eBGP, don't care, just peer
I got the same email last week, URL was paypal-verify dot tk or something
oops: 0000 [#1] SMP
Ip4:66.211.168.0/24 in the body or you looked it up after?
andreycore3 said:
Ip4:66.211.168.0/24 in the body or you looked it up after?
I looked it up after, obviously. PayPal does not paste their SPF blocks into customer emails. I maintain a local copy of their published records for comparison, updated weekly. The /24 I cited is from their current SPF, which includes several ranges. The full list is longer than I care to type on mobile.
What matters: the phishing campaign is using lookalike subdomains on expired legitimate domains with previously good reputation. Scavenged trust.
iBGP, eBGP, don't care, just peer