[clamav-users] Using paypal-communication.com for link tracking purposes

[Andy Schmidt]

>> The domain https://epl.paypal-communication.com is used by Paypal for
link tracking purposes in their emails. <<

There is nothing wrong with PayPal using the domain (or subdomains of)
paypal-communication.com as links in their emails.

Their HTML emails cannot disguise that link by showing a TEXT for that link
that uses a completely DIFFERENT domain name (e.g., http://www.PayPal.com).
If the displayed domain name does not match the ACTUAL domain name, then
this would normally be a major red flag that someone is trying to trick an
unsuspected user to click on a familiar/trusted domain name, even though the
actual link will take them somewhere completely different (normally a
phishing logon screen).

-----Original Message-----
From: Outreach at epsilon.com [mailto:Outreach at epsilon.com] 
Sent: Thursday, June 1, 2017 4:20 AM
To: ClamAV users ML <clamav-users at lists.clamav.net>
Subject: Re: [clamav-users] clamav-users Digest, Vol 150, Issue 19

Hi Reindl and Al,

Thank you for your feedback.

The domain https://epl.paypal-communication.com is used by Paypal for link
tracking purposes in their emails. Their sending domains are for example:
mail.paypal.com, mail.paypal.co.uk, mail.paypal.fr etc.

To clarify, I work for Epsilon which is a major Email Service Provider
(www.epsilon.com) and Paypal use our platform to deploy their emails, hence
me contacting you about this delivery issue.

I will pass back your feedback to Paypal so they can make a decision on
whether or not they will want to make any changes to their emails moving
forward.

Best regards,