Yahoo is sending email from no-reply@cc.yahoo-inc.com

jamieweb · on Nov 6, 2018

Try to check the SPF and DKIM against Yahoo's to help determine whether the email is real or not.

To answer your point though, it is unfortunately very common for organisations to use alternate domains for services you'd expect to have a high level of security.

For example many banks have their online banking portal on a completely separate domain. The main website might be "examplebank.tld", while the online banking portal is "examplebank-portal.tld".

Why they don't just use "portal.examplebank.tld" is a mystery...

mtmail · on Nov 6, 2018

Employees have @yahoo-inc.com email addresses so technically it's more trust-worthy than coming from @yahoo.com. A random internet user could register customerservice2018@yahoo.com, harder to impossible with yahoo-inc.com. The differentiation started 20 years ago when Yahoo! launched their email service. Yes, it's confusing. (Having a ! as part of your branding is also confusing).

saluki · on Nov 7, 2018

Hey, now that makes sense, I'd rather see inc.yahoo.com or official.yahoo.com but this makes sense. I'd never noticed/ran across it.

pwg · on Nov 6, 2018

If you are only looking at the email From: header value, that is trivial for a phisher to fake.

You really need to read all of the Received: headers to see where the email transited (and, note, a phisher can insert fake Received: headers as well, so you have to be careful analyzing them to detect something amiss).

Rjevski · on Nov 9, 2018

I would trust a random phisher way more than the real Yahoo.