Phish: Account Access

Here’s the e-mail:

Return-Path: lilla-afro-guy@hotmail.com
Received: from srjwaxw ([116.217.113.156]) by BLU0-SMTP45.blu0.hotmail.com over TLS secured channel with Microsoft SMTPSVC(6.0.3790.3959);
Sat, 20 Mar 2010 22:02:59 -0700
From: “wowaccountadmin@blizzard.com” <jayras@gmail.com>
To: <***@gmail.com>
Subject: World of Warcraft Account Password Verification

Greetings!
This is an automated notification regarding the recent change(s)
made to your World of Warcraft account. When you receive this message when your World Of Warcraft Account means that there are serious security risks.
We have evidence to prove your account has been in different countries and regions, several attempts to login.
However,if you did NOT make changes to your password,we recommend you click here Login verify your password.
If you are unable to successfully verify your password .
using the automated system, please contact Billing & Account Services at 1-800-59-BLIZZARD (1-800-592-5499) Mon-Fri, 8am-8pm Pacific Time or at billing@blizzard.com. Account security is solely the responsibility of the account holder. Please be advised that in the event of a compromised account, Blizzard representatives typically must lock the account. In these cases the Account Administration team will require faxed receipt of ID materials before releasing the account for play.
We encourage you to keep the following security tips in mind when playing a Blizzard game on any computer:
- Use up-to-date firewall, antivirus, and anti-spyware software to scan your system regularly for viruses, Trojans, and key-loggers.
- Keep your operating system and other software up-to-date and be careful when downloading new software.
- Be wary of “spoof” and scam websites and e-mails that pose as Blizzard Entertainment and request account or personal information. As a reminder, Blizzard Entertainment representatives will *never* ask you for your password.
- Use separate, unique passwords for your email, Battle.net account, and any other online accounts.
- Change your passwords regularly and keep Battle.net account information updated using the Account Management page at http://www.battle.net/account
For additional security tips and information, please visit the following site:
- Account Security: http://www.blizzard.com/support/article.xml?articleId=30472
If you are looking for an added layer of security, we currently offer the Blizzard Authenticator, an optional device that can help prevent unauthorized account access. For more information about how the Authenticator works or how to add one to an account, please visit the Blizzard Authenticator FAQ at http://www.blizzard.com/support/article.xml?articleId=30492.
Regards, World of Warcraft Support Team
Blizzard Entertainment
www.worldofwarcraft.com

OK, lets see..

  • Header shows it’s from Hotmail.
  • E-mail in general is completely nonsensical.

Gmail is protecting me, and the original e-mail is in MIME encoding so I can’t see where the link it taking you, but I bet it’s not Blizzard.

Overall, this e-mail is very poorly writing, I’m not even sure why its trying to convey.

I’m guessing they are saying that my account was accessed by someone other than me and I should change my password.

I love the statement: “When you receive this message when your World Of Warcraft Account means that there are serious security risks”

Its like WOA…WTF are you saying?

So, not Blizzard…

Update:

  • Received again:

Received: from pjkeqg ([116.217.113.73]) by BLU0-SMTP69.blu0.hotmail.com over TLS secured channel with Microsoft SMTPSVC(6.0.3790.3959);
Wed, 31 Mar 2010 23:10:34 -0700
Reply-To: <wowaccountadmin@blizzard.com>
From: “” <wowaccountadmin@blizzard.com>
To: <***@gmail.com>
Subject: World of Warcraft Account Password Verification

Links to: http://www.worldofwarcravft-login.com/

  • Received again:

Return-Path: mikkelloveskorn@hotmail.com
Received: from zdfylm ([119.114.99.33]) by BLU0-SMTP52.blu0.hotmail.com over TLS secured channel with Microsoft SMTPSVC(6.0.3790.3959);
Mon, 5 Apr 2010 07:29:19 -0700
From: “” <wowaccountadmin@blizzard.com>
To: <jayras@gmail.com>
Subject: World Of Warcraft Account Notification

Links to: http://www.worldofwarcroft-manage.com/

  • Received again:

Return-Path: ytalmadge@hotmail.com
Received: from trzxdyvl ([116.217.113.225]) by BLU0-SMTP23.blu0.hotmail.com over TLS secured channel with Microsoft SMTPSVC(6.0.3790.3959);
Tue, 6 Apr 2010 00:54:24 -0700
Reply-To: <wowaccountadmin@blizzard.com>
From: “” <wowaccountadmin@blizzard.com>
To: <jayras@gmail.com>
Subject: World of Warcraft Account Password Verification

Links to: http://www.wor1dofwareraft-login.com/

  • Received again:

Return-Path: croquet91@hotmail.com
Received: from zjny ([116.217.114.150]) by BLU0-SMTP69.blu0.hotmail.com over TLS secured channel with Microsoft SMTPSVC(6.0.3790.4675);
Sat, 24 Apr 2010 05:10:31 -0700
From: “” <wowaccountadmin@blizzard.com>
To: <jayras@gmail.com>
Subject: World Of Warcraft-Account Instructions

Links to: http://www.worldofwarcroft-test.com/

  • Received Again:

Return-Path: croquet91@hotmail.com
Received: from zjny ([116.217.114.150]) by BLU0-SMTP69.blu0.hotmail.com over TLS secured channel with Microsoft SMTPSVC(6.0.3790.4675);
Sat, 24 Apr 2010 05:10:31 -0700
From: “” <wowaccountadmin@blizzard.com>
To: <jayras@gmail.com>
Subject: World Of Warcraft-Account Instructions
Date: Tue, 1 Jan 2002 05:13:44 +0800

Links to: http://www.worldofwarcroft-test.com/

  • Received Again:

Return-Path: ge_knuckles@hotmail.com
Received: from xoz ([119.114.96.139]) by BLU0-SMTP70.blu0.hotmail.com over TLS secured channel with Microsoft SMTPSVC(6.0.3790.4675);
Wed, 12 May 2010 21:49:35 -0700
From: “” <wowaccountadmin@blizzard.com>
To: <jayras@gmail.com>
Subject: World Of Warcraft Account Notification

  • Received Again:

Return-Path: eddyclappy@hotmail.com
Received: from shpphlai ([119.114.98.148]) by BLU0-SMTP62.blu0.hotmail.com over TLS secured channel with Microsoft SMTPSVC(6.0.3790.4675);
Fri, 28 May 2010 01:30:09 -0700
From: “” <wowaccountadmin@blizzard.com>
To: <jayras@gmail.com>
Subject: World Of Warcraft Account Notification

  • Received Again:

Return-Path: sandraciszpb@hotmail.com
Received: from cdvuoyx ([119.114.98.148]) by BLU0-SMTP54.blu0.hotmail.com over TLS secured channel with Microsoft SMTPSVC(6.0.3790.4675);
Fri, 28 May 2010 13:03:08 -0700
From: “” <wowaccountadmin@blizzard.com>
To: <jayras@gmail.com>
Subject: World Of Warcraft Account Notification
Date: Fri, 16 Feb 2007 11:08:26 +0800

Ͼ http://www.pthkm.com/xpjylc/ http://www.pthkm.com/bgylc/ Ͼֳ http://www.pthkm.com/pjylc/ ewinֳ http://www.ybewv.com/ewinylc/ Ŷij http://www.ybewv.com/amdc/ ˰ټ http://www.eklhp.com/zrbjl/ Ŷij http://www.aojxq.com/amdcgl/ bet http://www.lpmwq.com/bet365ylc/ ȫѶ http://www.wfgpb.com/qxwgw/ 188 http://www.ywiql.com/jbb188gq/ bet http://www.nwiza.com/bet365ylc/ 365 http://www.rvodp.com/bet365tyzx/ Ͼ http://www.yjzhv.com/smxpjgw/ Ͼij http://www.utssx.com/ampjdc/ ˹˶ij http://www.bkrft.com/amwnsrdc/ Ͼij http://www.bkrft.com/pjdc/ ƶij http://www.bkrft.com/yddc/ Ŷij淨 http://www.bkrft.com/amdcwf/ ȫѶ http://www.bkrft.com/qxwzx/ ˹ά˹ij http://www.fldwd.com/lswjsdc/ ζij http://www.fldwd.com/lwdc/ ŶijЩ http://www.fldwd.com/amdcynx/ ij http://www.fldwd.com/mddc/ ˹˶ij http://www.fldwd.com/wnsrdc/ Ͼij http://www.yuwew.com/amxpjdc/ ĥij http://www.yuwew.com/mddc/ ijϷ http://www.yuwew.com/dcyx/ ĥƽij http://www.yuwew.com/mdhjdc/ ĥij http://www.hgvnk.com/lwmddc/ Űټ http://www.hgvnk.com/ambjl/ ټϷ http://www.hgvnk.com/bjlyx/ ˰ټ http://www.hgvnk.com/zrbjl/ http://www.dnczv.com/bcw/ Ŷij http://www.ybewv.com/amdc/ ˰ټ http://www.eklhp.com/zrbjl/ ټ http://www.zytygb.com/baijiale/ Ŷij http://www.luyouren.com/amdc/ ֳ http://www.yjzhv.com/ozylc/ Ŷij http://www.luyouren.com/aomenduchan/ bet http://www.lsylnj.com/bet365/ Ŷij http://www.lsylnj.com/amdc/ ټ http://www.lsylnj.com/bjl/ http://www.lsylnj.com/bcw/ ˹ http://www.lsylnj.com/wnsrylc/ Ͼ http://www.lsylnj.com/xpjylc/ ټ http://www.zytygb.com/baijiale/ Ŷij http://www.luyouren.com/aomengdushang/ ewinֳ http://www.luyouren.com/ewinyulechen/ bet http://www.luyouren.com/bet365/ ټ http://www.luyouren.com/bjl/ Ŷij http://www.luyouren.com/amdc/ Ŷij http://www.luyouren.com/amduchan/ Ŷij http://www.luyouren.com/aomendc/ Ŷij http://www.luyouren.com/aomenduchan/ Ŷij http://www.luyouren.com/aomengdushang/ ewinֳ http://www.luyouren.com/ewinylc/ ewinֳ http://www.luyouren.com/ewinylchen/ ewinֳ http://www.luyouren.com/ewinylec/ ewinֳ http://www.luyouren.com/ewinyulc/ ewinֳ http://www.luyouren.com/ewinyulechen/ http://www.dnczv.com/bcw/ ټ http://www.dnczv.com/bjl/ bet http://www.dnczv.com/bet365/ ˹ http://www.pthkm.com/wnsrylc/