I was learning about cold email marketing earlier this year, and it's all about learning to be a spammer:

- Registering lots of domains (launchmyapp.com, trymyapp.com, myapp.info, gomyapp.biz, etc.)

- setting up a limited number of mailboxes per domain

- warming email accounts up for 2 weeks by signing up for a service that sends to and receive messages from your accounts

- setting up a meta inbox to track messages sent and received across all of your accounts

Now pretty much every domain that isn't myapp.com looks like a spammer's domain to me.

They do the same with emails. I've got emails from them with links to paypal-communication.com. It's stupid.

Related: https://dev.to/phalkmin/comment/30pjg

This approach (using a separate domain for content that isn't part of their service itself) has security advantages-- for example, this way a compromise of their news site CMS can't expose users' PayPal session tokens.

It's decently common for websites to do this-- this is the same reason why Github Pages is hosted at github.io rather than github.com, and why static blobs are at githubusercontent.com. Those have a somewhat different threat model than PayPal's news site (hopefully PayPal isn't letting any random person add news stories...), but the premise is the same: if the thing does not need authentication tokens for the main service, make it so that it's impossible for it to get them.

(You could get some of the same effect by scoping your cookies to a specific subdomain rather than allowing them to apply to all subdomains, but (1) that's not always how you want to structure your site, and (2) it's really easy to mess up and inadvertently scope a cookie too broadly (or for the browser to misbehave and send to subdomains anyways, which was the default behavior of one very prominent browser for a really long time). Using a different domain entirely sidesteps all of this completely.)

This is common for corporate investor relations sites.

They serve entirely different audiences and are usually separately managed for the product sites, it’s also common for the latter to be blocked by the companies which are the target audience for the former.

Maybe we could introduce the concept of subdomains. Paypal could, for example, have a corp.paypal.com address that points to their corporate blog. I know, a bit out there, but maybe DNS2 will ship with this feature.

EV Certs used to do exactly that for me, that is until browser stopped make the visuals of it special. Don't think it would be even viable today given the short expiry (which is a good thing) of TLS certs necessary for browser

https://en.wikipedia.org/wiki/Extended_Validation_Certificat...

WHOIS used to be semi useful, though most records tend to be redacted for the average user now.

`dig` on DNS also, if it resolves to the same IP as paypal for example, that adds confidence. Though again, nowadays less useful due to a lot of things being behind Cloudflare.