Due to building my new business, I rarely have time to play World of Warcraft (WoW) anymore. I find it amusing now that I don’t play that I get phishing attempts, especially to an email account no longer linked to the account. Here is the email:
From: wowaccountadmin <wowaccountadmin@blizzard.com>
To: mouzer <xxxxxx@xxxxxxx.net>
Sent: Saturday, October 10, 2009 2:31:20 PM
Subject: World of Warcraft – Account Information Change InstructionsGreetings!
It has come to our attention that you are trying to sell/trade your personal World of Warcraft account(s).
As you may or may not be aware of, this conflicts with the EULA and Terms of Agreement.
If this proves to be true, your account can and will be disabled. It will be ongoing for further investigation by Blizzard Entertainment’s employees.
If you wish to not get your account suspended you should immediately verify your account ownership. If the information is deemed accurate, the investigation will be dropped.
This action is taken because we at Blizzard Entertainment take these sales
quite seriously. We need to confirm you are the original owner of the account..
This is easiest done by confirming your personal information along with concealed information about your account.
You can confirm that you are the original owner of the account by replying to this email with:
Use the following template below to verify your account and information via email.
* First and Surname
* Date of birth
* Address
* Zip code
* Phone number
* Country
* Account e-mail
* Account name
* Account password
* Secret Question and Answer
-Or-
WoW CD-Key
Show * Please enter the correct information
If you ignore this mail your account can and will be closed permanently. Once we verify your account, we will reply to your e-mail informing you that we have dropped the investigation.
We ask you to NOT change password until the investigation is fully completed.
Blizzard Entertainment Inc
Account Administration Team
P.O. Box 18979, Irvine, CA 92623
Regards,
Account Administration Team
Blizzard Entertainment
2009-10-11
wowaccountadmin
Looking a little deeper, it is easy to tell this is fake. To do this though, you have to be able to look at the Full Header. Each mail program and webmail site handles this a bit different. In Yahoo webmail, I just hit the Actions Button, and select Full Header to got a pop up screen showing the Full Message Headers content. Here is the header of the fishing email with the clues in Bold:
From wowaccountadmin Sat Oct 10 19:31:20 2009
X-Apparently-To: xxxxxx@xxxxx.net via 67.195.8.72; Sun, 11 Oct 2009 00:31:48 -0700
Return-Path: <drum_150@hotmail.com>
X-YMailISG: CLMtmbkWLDt2UbXYHjwDz3GY5Z3MDbVxt9ri8TfrBxbLtgCLxiGIzQnhD9fDPAlmdr4tVO7_5sYXqSmFr_CfH2qSwgGTI4Ed5PJV9bouWsNLSP8gkUPZHRrjDy5PDh4vrN7_KzA5l..fXgtt19Fdb91y8uM67MhntbiOePswQx6oCIezaGInYsZiRK9lg7Rdi_KrSwd9RF9jKM.u4oMMHNMVT_6BQczWRO7dfzKerO_iBybvIg3Q5jIbJoHRlYPy7shhpBdzmpAAo1MMa_IMmHh_nKQf2InxVDlxSn6wOZvvSKeSC0UKU6Z.Nr.uBXTqTFBqDrQ3yPCokDFHNjymHJSvExlVqoASID1aPei4qoPwezwYXfVRGoiw8UMhuhrh3IMX7wwpGQNzjy3.NrA-
X-Originating-IP: [65.55.111.157]
Authentication-Results: mta141.sbc.mail.mud.yahoo.com from=blizzard.com; domainkeys=neutral (no sig); from=blizzard.com; dkim=neutral (no sig)
Received: from 207.115.36.169 (EHLO nlpi155.prodigy.net) (207.115.36.169)
by mta141.sbc.mail.mud.yahoo.com with SMTP; Sun, 11 Oct 2009 00:31:48 -0700
X-Originating-IP: [65.55.111.157]
Received: from blu0-omc4-s18.blu0.hotmail.com (blu0-omc4-s18.blu0.hotmail.com [65.55.111.157])
by nlpi155.prodigy.net (8.13.8 inb ipv6 jeff0203/8.13.8) with ESMTP id n9B7Vl2N015162
for <xxxxxx@xxxxxx.net>; Sun, 11 Oct 2009 02:31:48 -0500
Received: from BLU0-SMTP59 ([65.55.111.136]) by blu0-omc4-s18.blu0.hotmail.com with Microsoft SMTPSVC(6.0.3790.3959);
Sun, 11 Oct 2009 00:31:47 -0700
X-Originating-IP: [114.94.67.251]
X-Originating-Email: [drum_150@hotmail.com]
Message-ID: <BLU0-SMTP59C0490813B5BAF9F6F95BAAC90@phx.gbl>
Received: from WWW-1984BD1A9E9 ([114.94.67.251]) by BLU0-SMTP59.blu0.hotmail.com over TLS secured channel with Microsoft SMTPSVC(6.0.3790.3959);
Sun, 11 Oct 2009 00:31:47 -0700
Date: Sun, 11 Oct 2009 03:31:20 +0800
From: “wowaccountadmin” <wowaccountadmin@blizzard.com>
Reply-To: wowaccountadmin@vip.citiz.net
To: “mouzer” <xxxxx@xxxxxx.net>
Subject: World of Warcraft – Account Information Change Instructions
X-mailer: Foxmail 6, 15, 201, 22 [cn]
Mime-Version: 1.0
Content-Type: multipart/alternative;
boundary=”=====003_Dragon570470480664_=====”
X-OriginalArrivalTime: 11 Oct 2009 07:31:47.0418 (UTC) FILETIME=[E3D63BA0:01CA4A44]
Content-Length: 5949
It is very easy to see that email is not really associated with Blizzard by the “Reply-To: wowaccountadmin@vip.citiz.net” and “X-Originating-IP: [114.94.67.251]
X-Originating-Email: [drum_150@hotmail.com]” parts.
If you get an email like this and you are still concerned about your account, just contact Blizzard using a phone number from their website. Or, simply check the Full Headers for clues. Read the rest of this post »
