May 13th 2009 05:26 am
PHISHING EMAIL ALERT: DIFFERENT EMAIL ADD, SAME SET OF THIEVES
Something’s always getting in the way of writing the next review — recent gold drought, Nantucket, a host of stupid scammy newsletters, that blind date I had yesterday (no I don’t wanna talk about it!) . And this morning, just as I was checking my email, I saw the equivalent of the Satanic verses in the inbox:
From: wowaccountadmin@blizzard.com <wowaccountadmin@blizzacd.com >
Date: 2009/5/13
Subject: World of Warcraft - Account Issue
Greetings!
It has come to our attention that you are trying to sell/trade your personal World of Warcraft account(s). As you may or may not be aware of, this conflicts with the EULA and Terms of Agreement.
If this proves to be true, your account can and will be disabled. It will be ongoing for further investigation by Blizzard Entertainment’s employees. If you wish to not get your account suspended you should immediately verify your account ownership. If the information is deemed accurate, the investigation will be dropped.
This action is taken because we at Blizzard Entertainment take these sales quite seriously. We need to confirm you are the original owner of the account. This is easiest done by confirming your personal information along with concealed information about your account.
You can confirm that you are the original owner of the account by replying to this email with:
Use the following template below to verify your account and information via email.
* First and Surname
* Date of birth
* Address
* Zip code
* Phone number
* Country
* Account e-mail
* Account name
* Account password
* Secret Question and Answer or Cd-Key
If you ignore this mail your account can and will be closed permanently. Once we verify your account, we will reply to your e-mail informing you that we have dropped the investigation. We ask you to NOT change password until the investigation is fully completed.
Blizzard Entertainment Inc
Account Administration Team
P.O. Box 18979, Irvine, CA 92623
Regards,
Account Administration Team
Blizzard Entertainment
I can’t believe they’re at it AGAIN! Those thieving SOBs!
But this time, they have a slightly different email address: wowaccountadmin@blizzacd.com
Ooooh boy, the things we can do with that email address.
Like submit it to every gay porn mailing list.
Did anyone else get this email from the above address? If yes, I sincerely hope no one fell for this trap.
Spread the word: the phishing gang is back!
Related posts
5 Comments »
Hot "F"udge on 13 May 2009 at 10:20 am #
Yeah! Yeah! I know that e-mail. Sometimes, they will ask you to click on a link which directs you to a fake blizzard website. Then, they will ask you to fill-out and click on some stuff related to your account. And if you’re stupid enough, you won’t notice the Blizzard logo was like edited in MS Paint. :3
meatwad on 13 May 2009 at 12:20 pm #
“wowaccountadmin@blizzacd.com” huh! smells phishy!
for someone lazy or gullible, he/she would think that its from “wowaccountadmin@blizzard.com.”!
Matt-ematician on 13 May 2009 at 3:08 pm #
Smell phishy? I think I smell an eye game…which is the correct one?
wowaccountadmin@blizzzard.com
wowaccountadmin@blizzard.com
wowaccountadmn@blizzard.com
wowaccountadmin@bilzzacd.com
wowacccountadmin@blizzard.com
wowaccountadmin@blizzard.com
wowaccountadmin@blizzand.com
wowaccountadmin@blizarrd.com
wowaccuontadmin@blizzard.com
wowacountadmin@blizzard.com
Lestat de Lioncourt on 14 May 2009 at 1:14 pm #
Very clever. Not everyone can notice that. I bet this guy already had a lot of victims. Poor people.
not_scammed on 19 Sep 2009 at 1:31 pm #
…upon inspecting the message source:
X-Message-Delivery: Vj0xLjE7dXM9MDtsPTA7YT0xO0Q9MTtTQ0w9MA==
X-Message-Status: n:0
X-SID-PRA: wowaccountadmin
X-Message-Info: JGTYoYF78jEA3ZgVNHIpQ7YaChJLtmpK4WwgVPjI8GgcBzcXq1lA4A28fPuE7+ECrLSe/yAYOXao1qRtlvsydREAtZQc5tAB
Received: from blu0-omc4-s20.blu0.hotmail.com ([65.55.111.159]) by bay0-hmmc2-f9.Bay0.hotmail.com with Microsoft SMTPSVC(6.0.3790.3959);
Sat, 19 Sep 2009 03:01:21 -0700
Received: from BLU0-SMTP75 ([65.55.111.137]) by blu0-omc4-s20.blu0.hotmail.com with Microsoft SMTPSVC(6.0.3790.3959);
Sat, 19 Sep 2009 03:01:05 -0700
X-Originating-IP: [58.48.71.232]
X-Originating-Email: [tim_watson97@hotmail.com]
Message-ID:
Return-Path: tim_watson97@hotmail.com
Received: from PC-20060104GTWB ([58.48.71.232]) by BLU0-SMTP75.blu0.hotmail.com over TLS secured channel with Microsoft SMTPSVC(6.0.3790.3959);
Sat, 19 Sep 2009 03:01:04 -0700
Date: Sat, 19 Sep 2009 18:01:10 +0800
From: “wowaccountadmin”
Reply-To: wowaccountadmin@vip.eyou.com
To: “this information is private ;)”
Subject: World of Warcraft - Account Information Change Instructions
X-mailer: Foxmail 6, 15, 201, 22 [cn]
Mime-Version: 1.0
Content-Type: multipart/alternative;
boundary=”=====003_Dragon088754261478_=====”
X-OriginalArrivalTime: 19 Sep 2009 10:01:05.0235 (UTC) FILETIME=[1A062230:01CA3910]
tim_watson97@hotmail.com
which begs the question:
is the scammer really stupid enough to use his own e-mail account? (i only speculate this as a possibility b/c the attempt was so pathetic…)
wowaccountadmin@vip.eyou.com
yeah…
58.48.71.232 : CN CHINA HUBEI WUHAN CHINANET HUBEI PROVINCE NETWORK
there we go…oh neat, a map!! : http://www.ip2state.com/map.asp?s=ip&city=WUHAN&lat=30.583&long=114.267&ses=573626228
tim watson, chinaman.
/that rug really tied the room together.