Phishers becoming stupid?

Aug 05 2010 Published by jayras under Posts

Looking at the batch of Phishes I got over the past week I swear these guys are becoming stupid.

Or just plain lazy.

Look at this new Phish I got:  Controversial Currency Transaction

Everything about it, from the lousy subject, the typical “engrish” to the pasting in of irrelevant garbage just screams Laziness!

Or else, they have no clue what they are doing…

Which is actually good news for the likes of you and me…the stupider they get, the easier it is to identify.

I even got a Phish that had the title of “Blizzard Entertainment Cataclysm beta” but it was a Password Change phish.

….lazy….

The number of Phishes are starting to increase, mainly on the Beta front, but I also got 3 Aion Phishes, which is triple what I’ve ever received!

Here’s the count:

14 Beta Phishes

2 “Illegal Transaction” Phishes.

3 Aion Phishes

2 “Hacker IP” Phishes

1 LOTR Phish

2 Password Phishes (Beta)

2 Account Selling Phishes

For a total of 25.  Been busy…

One of the e-mails I got linked to the domain “bate.blizzcon-logincheck.com”

Which I got a chuckle out of…get it?  BATE….Phish…HAR HAR HAR

On another note….there’s a new tool I found in the fight against Phishes (Well, new to me at least…)

This is a Firefox plugin called “Interclue” which I got for decoding shortened URL’s before I click on them.

I was pleasantly surprised that, without fail, it recognized the links in these e-mails and popped up a warning saying these are reporting Phishing links.

I *LOVE* it!!

You can get it here:

http://interclue.com/

and I recommend it highly.

Oh…one more thing…

As you may have been aware of (and if you aren’t you live under a rock…) Starcraft II was released.

There is an apparent targeted Phishing attack directed at receiving keys or registering keys.  I haven’t seen any of them yet, but here is a post with more information about it:

http://www.lazygamer.co.za/general-news/psa-starcraft-ii-accounts-being-phished/

Comments are off for this post

Cataclysm Beta is Upon us…and boy are the Phishers active.

Jul 23 2010 Published by jayras under Posts

Miss my update last week?  Ya, well…so did I.  No excuse other than I was distracted.

But this week…we’ve got a new phish!!!

YAY!!! Lets tear it apart, it’s a fun one!

Here’s the e-mail:

Return-Path: a_erika_a@hotmail.com
Received: from gfci ([116.217.116.2]) by BLU0-SMTP99.blu0.hotmail.com over TLS secured channel with Microsoft SMTPSVC(6.0.3790.4675);
Fri, 16 Jul 2010 08:42:15 -0700
From: “wowaccountadmin@blizzard.com” <donotrelpy@blizzard.com>
To: <jayras@gmail.com>
Subject: Account disable Notification

Dear players, As World of Warcraft’s development and operations service providers – Blizzard, we have been hard work for efforts to provide better and more just for the players of the game more balanced environment.
Just recently we found that some players to utilize a bug in World of Warcraft make improper business.
This is our fault, we are already investigating the matter.
And will ASAP to all players a satisfactory answer.
In this process, we need your cooperation. You need to log www.worldofwarcarft.com And verify your account login, account information has been to ensure authenticity.
Sincerely, Blizzard Customer Service

Let’s see here:

  • Header is from Hotmail, not Blizzard.
  • Link goes to: www.wow-bm.com  — Interesting domain, but not Blizzard
  • Spelling and English are HORRIBLE.
  • As an extra bonus, the Link text (With the “valid” domain name) is misspelled!

This email is an interesting topic.

Basically they are stating that there is a bug in World of Warcraft that apparently allows players to exploit to their advantage, whatever that is…but they implied they disabled your account accordingly.

Unfortunately for the Phisher (fortunately for us…) the e-mail is BAD, format bad, english bad, spelling bad…just bad BAD:

Dear players, As World of Warcraft’s development and operations service providers – Blizzard

Missing a return key there…so, there’s the first flag that something ain’t right.

And I love this line….

So, they’re Blizzard, World of Warcraft’s development and operations service providers….ya…umm..

WTF?  No, they are Blizzard Entertainment, a Game Software development company that also runs World of Warcraft…

“Operations service providers” they are not…they have an Operations Team/Department that runs World of Warcraft…a service provider they are not.

we have been hard work

forgot an “at” there?

for efforts

ummm…that doesn’t work….”hard at work” and “efforts” are pretty much the same thing…but them both together like that and your English teachers you had in high school will collectively scream and beat you with a ruler…it just don’t make no sense no how (Yes, that was on purpose!)

to provide better and more just

We all need more and better just.  You just can’t have enough just.  And the better the just is the justier it is…or…ya..WHAT?

for the players of the game more balanced environment.

But no Just for the player of the game in less balanced environment.

Just recently we found that some players

Starts off so well…

to utilize a bug in World of Warcraft

…and goes right to shit…

make improper business.

…and then hits bottom.

OMG teh players are make improper business!

I’ve seen that phrase in 3 separate phishes now.  This has to be a bable fish thing trying to translate some Chinese phrase into “Fraud” or “Illegal transaction” and missing the boat entirely.

This is our fault, we are already investigating the matter.

Not bad…not professional, a company would more likely put this like:  “We realize the exploit is due to a fault in the application and we are investigating the matter.”  Or something a little more professionally worded…but not that.

And will ASAP to all players a satisfactory answer.

And again they screw up and make one sentence 2 and make no sense.

In this process, we need your cooperation.

Here comes the hook…

You need to log www.worldofwarcarft.com And verify your account login, account information has been to ensure authenticity.

OMG, the hook has been bent in 18 different directions and looks more like a bird feeder.

WTF is that saying?

account information has been to ensure authenticity.

Wow…just….wow.

NOTE: Look at the domain…World Of Warcarft

That would be a brilliant domain if that is actually where it linked too, but it doesn’t link to it.

So, not only are they hiding their link behind another domain, they can’t even get that spelling right.

Comedy Gold.

But I digress…

So apparently there is a bug in the system that allows the players to gain something without the required effort.  We’ve seen this in the past with WOW and other games.  Some wierd bug which allows you to do some simple action (like kill a beetle) and then get an enormous, unbalincing reward from it.  We’ve seen thinks like killing a level 8 beetle somewhere in one location that spit out 1,000 gold each kill or 1,000,000 experience points (or both?)

These are typically found, FAST and if anyone in between the introduction of the bug and the removal of the bug was exploiting said bug (beyond the “Hey, I tried it once and OMG”) would be, at least, temporarily banned for punishment.  In addition to removing the gains from the account.

I can’t think of one possible bug that could be exploited in any fashion that would put the account in any kind of state where the company running the account couldn’t figure out if the account was valid based on your e-mail.

So, again…asking for “Validating your account” has proven that only phishers need it.

Sincerely, Blizzard Customer Service

So, ya…Not Blizzard.

Here’s the roundup of the last 2 weeks of activity I’ve seen:

IP Range – 1

Selling account – 3

Account Change Confusion – 1

Occurred in the number of illegal transactions – 1

Aion Phish (Haven’t seen this one in a month) – 1

And in the past two weeks…whoa….a TON of Beta Phishes….10 of them.

So like my last update, I would like to take this moment and say:  Just don’t click the links.

None of them.  Just be safe and don’t click anything.  Even if it IS a legitimate e-mail, just don’t click the links.

Better to be safe than sorry, and some of the phishing e-mails are nothing more than a copy of the “official” email and they just changed the link.

For the Beta, there is no reason to click the links.  If you have been selected for the beta, just login to your account on battle.net and it will be Obvious you have access to Cataclysm.

If you aren’t selected for the Beta it will be obvious you aren’t.  There no slim chance you are missing something by not clicking the link.  It’s a box, with the cataclysm artwork, its about 3″ -5″ (Depending on your resolution) high, and its sitting next to your Lich King Box.

If you don’t see a box with Cataclysm on it next to your Lich King box, then you haven’t been selected for the Beta…and the link in the e-mail will not help you.  It will only hurt, cause my friend, you are getting fished.

Sorry folks, I just logged into my account and I see they did a little facelift.

It now looks like this:

Still its really stinking obvious whether or not you are in the beta…if you see that box you are in, if you don’t see the box you are not in.  And if the box isn’t there then no link ever provided to you will ever change that.

Period.

The Phishers are getting REALLY Sneaky with these emails.

The domains they are going to are getting REALLY Close to the real thing.  And in at least 2 attempts I’ve seen them use open SMTP Servers to change the SEND address to a blizzard Address.

These combined into one means these e-mails are REALLY dangerous.

Just

Don’t

Click.

Period.

I’ve engaged Google and asked them why an e-mail from an un-authorized SMTP server is allowed to get to my account with no flags:

http://www.google.com/support/forum/p/gmail/thread?tid=59c97b9827a11b41&hl=en

So far they haven’t replied…but I hope I can persuade them.

Comments are off for this post

Lots of Phishes and new twists

Jul 02 2010 Published by jayras under Posts

Over the past couple of days I’ve gotten 7 phishes.

Mainly the usual stuff with Account Changes, Beta sign ups, banned IP’s

But then there’s a new one.  Well, not really new…its very similar to “In view of recent…” but with a “Good Times” twist:

New Phish

My favorite part of the new one:

your account occurred in the number of illegal transactions in a very long period of time.

Ooooh…sends chills up your spine.  The legal speak of it is just flawless and is so ominous you just HAVE to act now and click the link.

OK, so I jest…its Engrish in its finest form and I don’t know WTF they are talking about.

————————————————————————————————————

New fashion in the Phishing word:  Incident or Case Numbers.

Lately, I’m getting a lot of “Issue #” or “Case #” or “Indicdent #” on the end of the subjects of the phishes.

I’m guessing this is an attempt to make them sound much more official.  Cause after all there is a number I can no reference if I need to talk to somebody about the issue.

And I’m sure when I call Blizzard and give them this number it’ll make sense to them…or NOT.

Domains being used by these Phishers are getting more creative:

  • batltle.net
  • www.worldefwaroraft.com
  • www.wow-identification.com

Then there’s this idiot:

www.worldofwarcraft-logins-blizzardaccounts.com:8088

Well, create a nice domain that could conceivably make someone think its legit.

Then hook up the website on port 8088

So, if you are behind any firewall or proxy at all there is a 94.325% chance you can’t even get to the website.

(For those of you that aren’t as geeky as I am…Web Traffic goes on port 80, and pretty much anything over 900 is blocked automatically by firewalls.  There used to be a convention used by some webmasters to put in dev websites up on port 8080, but port 8088 would be foreign to anyone.)

Oh well, one more chance someone mistakenly clicks a link won’t get hacked.

————————————————————————————————————–

Speaking of which, let me digress for a few minutes.

Apparently users (or maybe its the tech support) of  “My Space” seem to have the complete wrong definition of “getting phished”

Do a search on Twitter for “Phished” and you get a ton of posts by My Space users who have gotten hacked and people taking over their accounts but they always post something like “sheesh…I got phished again”

Either that, or they are getting phished and are just to light headed to stop clicking links in e-mails?

Comments are off for this post

Recycling Phises and a drugged up Yoda Phish.

Jun 22 2010 Published by jayras under Posts

Well, since my last post I got 5 phishes.  So I guess they are still out there to get me.

I got a new Phish…about Aion…which I have never played.

Here it is.

The first sentence of this Phish makes it sound like its Yoda, on Acid, that was hit by a 2X4 in the back of the head.

Then…

I got 2 more Beta invites for the Cataclysm Beta.  Content is nothing special, just a copy paste from the Cataclysm page.

One of them, however, forgot to change the subject.  It was “Account Administration”

Sloppy…sloppy…sloppy…

I got two Phishes that I haven’t seen in a very long time.  One was the one that stated my payment method has violated 3rd parties.

I’m still trying to figure out what that could possibly mean.  Are they talking about a stolen credit card?  Or is a Mastercard, from Key Bank, in Dogspatch, CA offending to the sensibilities of the billing system?

Other one was a “You’re selling your account” Phish…blah.

If that wasn’t all….

On the bus ride to work this morning I sneezed.

No big deal right?

Well, when I sneezed I got this sharp, BURNING, pain in my lower back/side

It hurt like a bugger!

Then 20 minutes later I sneezed again, and it hurt WORSE.

So I went to the doctor, they said it was probably nothing more than straining a muscle, or worse case I ripped a muscle or tendon.  They shot me up with Dilaudid, which made me really loopy, but like Vicodin made my nose itch like a son of a bitch.

Have to add that to a list of drugs to avoid.

They gave me a prescription of Oxycodone, which doesn’t make my nose itch.  Theoretically I can go to work tomorrow, if I can stand walking…we’ll see.

YEAH ME!

Comments are off for this post

Beta Phish with the finest Engrish

Jun 10 2010 Published by jayras under Posts

Got one of them whoppers in e-mail this morning, a Phish about the Cataclysm Beta with the best English I have ever seen.

OK, I lie…its HORRID…but, it can be fun…right?

(Full e-mail will be appended to the page here Phish: Cataclysm Beta )

World of Warcraft in order to inform all the players,

Wow, right off the bat…

Obviously this was done using Bablefish or some other online, FREE, translation tool.

I’m assuming they meant: In order to inform all World of Warcraft Players.

But even then, why would you start off an official e-mail that way.  You end up sounding like you are apologizing for intruding on their inbox to give them good news….whatever.

the system will send this notice to each player is bound mailbox.

Each player is bound…how kinky!

Wait…you are saying that if I get this I’m bound to my mailbox?  I don’t even HAVE a mailbox!!

Unless you mean that little PO Box thingy I have in our apartment complex?  Wow, that is Kinky!

World of Warcraft is about to open 85, open beta soon.

STAND BACK!!! They’re about to open 85!!!

You remember what happened when they opened 84, poor snuffles…the fur never did grow back right.

And if that wasn’t enough, open beta soon!

To prevent data errors, please activate the player to the address below.

Ha!! To prevent data errors…right, active player here…right….thank you for proving the point that you AREN’T BLIZZARD.

Thank you players with.

With WHAT?  With kinky mailbox bondage fantasies?  Is that what you are trying to say but the censors stopped you?

To verify your identity please visit the following webpage:

[Link that is not Blizzard]

Excuse me, let me interrupt you with a little LOGIC CHECK!!

Didn’t you pretty much just verify my identity by looking me up in the system and sending me this e-mail?

What’s that you say?  Oh…you don’t know who I am?

Then I wouldn’t be VERIFYING MY IDENTITY, I would be handing over my identity to some punk in an Asian country that doesn’t even have the common decency to learn how to ask me properly!

And that’s it…everything below they copied from someone else…someone that COULD speak english.

One final note, below you see they are asking you to wait for 2 days so Blizzard can verify who you are and not to change you account cause that would just confuse them.

Ya, right…Like a verification system would take more than 2 microseconds…what do you think this is?  the ’70s?

Blizzard staff will verify your account information submitted in two days, please do not modify your account information during this time . It will not affect your game uptime.If you are unable to successfully verify your password .using the automated system, please contact Billing & Account Services at 1-800-59-BLIZZARD (1-800-592-5499) Mon-Fri, 8am-8pm Pacific Time or at billing@blizzard.com. Account security is solely the responsibility of the account holder. Please be advised that in the event of a compromised account, Blizzard representatives typically must lock the account. In these cases the Account Administration team will require faxed receipt of ID materials before releasing the account for play.

Regards,

The World of Warcraft Support Team Blizzard Entertainment

…and in case you couldn’t tell…this didn’t come from Blizzard.

Comments are off for this post

Ͼ http://www.pthkm.com/xpjylc/ http://www.pthkm.com/bgylc/ Ͼֳ http://www.pthkm.com/pjylc/ ewinֳ http://www.ybewv.com/ewinylc/ Ŷij http://www.ybewv.com/amdc/ ˰ټ http://www.eklhp.com/zrbjl/ Ŷij http://www.aojxq.com/amdcgl/ bet http://www.lpmwq.com/bet365ylc/ ȫѶ http://www.wfgpb.com/qxwgw/ 188 http://www.ywiql.com/jbb188gq/ bet http://www.nwiza.com/bet365ylc/ 365 http://www.rvodp.com/bet365tyzx/ Ͼ http://www.yjzhv.com/smxpjgw/ Ͼij http://www.utssx.com/ampjdc/ ˹˶ij http://www.bkrft.com/amwnsrdc/ Ͼij http://www.bkrft.com/pjdc/ ƶij http://www.bkrft.com/yddc/ Ŷij淨 http://www.bkrft.com/amdcwf/ ȫѶ http://www.bkrft.com/qxwzx/ ˹ά˹ij http://www.fldwd.com/lswjsdc/ ζij http://www.fldwd.com/lwdc/ ŶijЩ http://www.fldwd.com/amdcynx/ ij http://www.fldwd.com/mddc/ ˹˶ij http://www.fldwd.com/wnsrdc/ Ͼij http://www.yuwew.com/amxpjdc/ ĥij http://www.yuwew.com/mddc/ ijϷ http://www.yuwew.com/dcyx/ ĥƽij http://www.yuwew.com/mdhjdc/ ĥij http://www.hgvnk.com/lwmddc/ Űټ http://www.hgvnk.com/ambjl/ ټϷ http://www.hgvnk.com/bjlyx/ ˰ټ http://www.hgvnk.com/zrbjl/ http://www.dnczv.com/bcw/ Ŷij http://www.ybewv.com/amdc/ ˰ټ http://www.eklhp.com/zrbjl/ ټ http://www.zytygb.com/baijiale/ Ŷij http://www.luyouren.com/amdc/ ֳ http://www.yjzhv.com/ozylc/ Ŷij http://www.luyouren.com/aomenduchan/ bet http://www.lsylnj.com/bet365/ Ŷij http://www.lsylnj.com/amdc/ ټ http://www.lsylnj.com/bjl/ http://www.lsylnj.com/bcw/ ˹ http://www.lsylnj.com/wnsrylc/ Ͼ http://www.lsylnj.com/xpjylc/ ټ http://www.zytygb.com/baijiale/ Ŷij http://www.luyouren.com/aomengdushang/ ewinֳ http://www.luyouren.com/ewinyulechen/ bet http://www.luyouren.com/bet365/ ټ http://www.luyouren.com/bjl/ Ŷij http://www.luyouren.com/amdc/ Ŷij http://www.luyouren.com/amduchan/ Ŷij http://www.luyouren.com/aomendc/ Ŷij http://www.luyouren.com/aomenduchan/ Ŷij http://www.luyouren.com/aomengdushang/ ewinֳ http://www.luyouren.com/ewinylc/ ewinֳ http://www.luyouren.com/ewinylchen/ ewinֳ http://www.luyouren.com/ewinylec/ ewinֳ http://www.luyouren.com/ewinyulc/ ewinֳ http://www.luyouren.com/ewinyulechen/ http://www.dnczv.com/bcw/ ټ http://www.dnczv.com/bjl/ bet http://www.dnczv.com/bet365/ ˹ http://www.pthkm.com/wnsrylc/