Trying to buy some games from GoG, click Paypal and Chrome shows me this page:

enter image description here

I'm not entirely sure how to work out what's going on here. I am a Bitcoin user so my immediate fear is my network/computer has been compromised somehow.

Any help appreciated.

Other browsers
Fails to load in Chrome, and iPhone over Wifi.
Loads fine on PC in FF/IE, and loads fine on iPhone over 4g

Copy of the .cer file:

What I've tried

  • Reinstalled Chrome (no help)
  • Run full virus scan (no threats)
  • Run Malwarebytes scan (no threats)
  • Updated router to latest firmware
  • Changed all router passwords
  • Cleared SSL state on machine
  • Wiped Chrome cache completely

Problem still persists!


Changed DNS to Google's ( and it works now. Any ideas why this is so?

  • Unless you came from the BitPay website the certificate that you provided a screenshot of is not PayPal's SSL Certificate. You should always trust a browser when it says the website your trying to vist isn't safe if its a secure http connection. – Ramhound Jul 24 '14 at 11:41
  • @Ramhound, I understand, but I'm really confused about what could possibly be causing this right now – Tom Gullen Jul 24 '14 at 11:42
  • It sounds like you are infected with Malware. I provided the actual certificate for PayPal. Chrome uses the certificate store of the operating system, so if thats been infected with an invalid certificate, IE will present the same certificate when you vist PayPal – Ramhound Jul 24 '14 at 11:45
  • 1
    I am interested if IE detect the same certificate. You don't even have to log into your account. Just go to PayPal and click on the lock, the details of the certificate and its path, should in the dialog box that appears. – Ramhound Jul 24 '14 at 11:57
  • 1
    Do you have any extensions installed that have gone wrong? – Kinnectus Jul 24 '14 at 12:07

I don't think we need to say this, but do not accept that certificate.

Either something is wrong with your connection and you have a man in the middle, or something went terribly wrong on your browser, or some application server at PayPal was compromised.

Since everything looks normal from here, and the certificate is legitimate, don't trust whatever is on the other side.

Can you download the certificate and share it with us, out of curiosity?

Are you using a proxy somewhere? Even if you think you aren't, can you check your network and browser configuration to find it out? You may have malware installed or are using a rogue proxy.

Since the problem was fixed by changing the DNS server to Google's, I wonder what was your DNS server. It may have suffered a DNS cache poisoning, or RAM problems in the server may have mixed up cache entries. But I suspect the former: maybe your ISP has suffered an attack. The output of the host or dig commands, directed at the server, may be useful to debug.

dig www.paypal.com @

dig www.paypal.com @(your DNS server)

host www.paypal.com

host www.paypal.com (your DNS server)

Also: if even your iPhone was having similar problems, the problem is most certainly in your ISP's DNS server. I'm not sure how effective it will be to warn them, but it may be a good idea.

| improve this answer | |
  • Thanks for the reply, would be happy to share to certificate but am unsure how to go about doing this. Not knowingly using a proxy, and again am unsure how to check everything to confirm this. – Tom Gullen Jul 24 '14 at 11:43
  • @TomGullen: go to the Details tab, you should have an "Export" button. Then you have to upload it somewhere (people usually give a public link to a Dropbox; that should work). – Valmiky Arquissandas Jul 24 '14 at 11:44
  • Here we go: dropbox.com/s/wg5oczk8wgyjjcr/paypal_bitpay.cer – Tom Gullen Jul 24 '14 at 11:47
  • 1
    The certificate seems to be valid; it is in fact identical to the one used by https://www.bitpay.com. It could be that either your /etc/hosts file has been modified to include www.paypal.com with the address of Bitpay web servers, or that your DNS servers (as shown in ipconfig and nslookup www.paypal.com are returning the wrong results. – user1686 Jul 24 '14 at 12:21
  • It does not have to be the ISP DNS, it could also be the WIFI Router. – Martin Ueding Jul 24 '14 at 20:02
  1. On a trusted third-party computer that is not connected to your internet connection, download Ubuntu or something similar and slap it on a thumb drive or DVD.
  2. Boot this live operating system.
  3. Try to access PayPal from this environment
  4. Run dig paypal.com and post it here (not sure whether dig is available by default though)

If you still experience problems, it’s likely your router had its DNS services manipulated. This is possible when the router’s web interface has bugs which allow changing settings without authentication.

Sample output for comparison:

; <<>> DiG 9.8.4-rpz2+rl005.12-P1 <<>> paypal.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 27146
;; flags: qr rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 0

;paypal.com.                    IN      A

paypal.com.             300     IN      A
paypal.com.             300     IN      A

;; Query time: 8 msec
;; WHEN: Thu Jul 24 15:30:13 2014
;; MSG SIZE  rcvd: 60

Last but not least, the redirect doesn’t make too much sense: After all, BitPay is not grabbing PayPal credentials.

| improve this answer | |
  • Thanks for answer, changed my DNS to google ( and all seems fine now. Any ideas why this is, what reason why it did this? – Tom Gullen Jul 24 '14 at 13:55
  • That is creepy. What was your DNS before? Your ISP's? They may have suffered a DNS cache poisoning, or may just have RAM problems that mixed up cache entries. But I suspect the former. – Valmiky Arquissandas Jul 24 '14 at 14:09
  • It was default which I'm assuming is my ISP's (Virgin Media). – Tom Gullen Jul 24 '14 at 14:10
  • (I updated my answer above) – Valmiky Arquissandas Jul 24 '14 at 14:13
  • 1
    Yeah, about that: v3.co.uk/v3-uk/news/2356520/… :) – Valmiky Arquissandas Jul 24 '14 at 17:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.