Phish: Aion

Here’s the e-mail:

Return-Path: steph1650@hotmail.com
Received: from xdukpom ([122.139.26.139]) by BLU0-SMTP53.blu0.hotmail.com over TLS secured channel with Microsoft SMTPSVC(6.0.3790.4675);
Fri, 18 Jun 2010 20:38:46 -0700
From: “NCsoft Support”
To: <jayras@gmail.com>
Subject: Aion account lockout notice

jayras

Your account fraud Aion other members account password. Prohibited for 72 hours. As soon as possible to verify your account login [Don't click that link!]
If you do not verify your account as soon as possible, your account will be permanently locked!

GM Ash
Aion Game Surveillance Unit

Let’s see here:

  • Header shows it’s from Hotmail.
  • Rudimentary, but poor, attempt at personalization.
  • Spelling, english horrible.
  • e-mail makes no sense whatsoever.3
  • Links to: aion.dipns.com

To quote Steven King:  Jumping Jesus on a Pogo Stick!

WTF is that first sentence even TRYING to say?

Your account fraud Aion other members account password.

Most of these non-english speaking hackers using Bablefish I can figure out the gist of their message, but this one eludes me.

The backward speak is almost akin to Yoda speak…but still….

Wait, I know what it is:

1. Take Yoda and give him Acid.
2. Make Yoda watch Fantasia.
3. When the scene comes up where the Hippos are dancing with the alligators THWACK him in the back of the head with a 2X4

That’s what that sentence looks like.

Prohibited for 72 hours.

Well, that sentence is equally as useless, but at least I can understand it.  I just don’t know what is prohibited for 72 hours?  And after 72 hours whatever action that is will be allowed again?

As soon as possible to verify your account login [Link that is not NC Soft or Aion]
If you do not verify your account as soon as possible, your account will be permanently locked!

There’s a twist. Not only do I need to “verify I am how you are e-mailing” but I do that by logging in.

Wait…

I feel like I’ve just been insulted.

This e-mail is about one of two things.

Either they caught me doing something illegal and have “banned” me for 72 hours.

Or they think I was hacked and have locked me out for 72 hours.

But MAGICALLY, if I login (as this is ME and not anyone else) I’ll be verified and I’ll be able to get back in?

Wow…that logic tree just died.

So ya, not NC Soft (or Blizzard…)

Update:

  • Received again:

Return-Path: yolis.68@hotmail.com
Received: from gr ([98.126.10.160]) by BLU0-SMTP26.blu0.hotmail.com over TLS secured channel with Microsoft SMTPSVC(6.0.3790.4675);
Wed, 21 Jul 2010 20:17:31 -0700
Reply-To: <support@ncsoft.com>
From: “NCsoft Support” <support@ncsoft.com>
To: <jayras@gmail.com>
Subject: Aion Account Identification:mwkdd5hg

Links to: www.access-ncsoft.com

  • Received again:

Received: from lyx ([98.126.10.160]) by BLU0-SMTP10.blu0.hotmail.com over TLS secured channel with Microsoft SMTPSVC(6.0.3790.4675);
Fri, 23 Jul 2010 18:07:19 -0700
Reply-To: <support@ncsoft.com>
From: “NCsoft Support” <support@ncsoft.com>
To: <jayras@gmail.com>
Subject: Aion Account Identification:yqiyfuay

Links to: www.aionverify-ncsoft.com

  • Received again:

Return-Path: jared4520@hotmail.com
Received: from yrhqpbkz ([183.90.187.103]) by BLU0-SMTP21.blu0.hotmail.com over TLS secured channel with Microsoft SMTPSVC(6.0.3790.4675);
Sun, 25 Jul 2010 00:53:26 -0700
Reply-To: <support@ncsoft.com>
From: “NCsoft Support” <support@ncsoft.com>
To: <jayras@gmail.com>
Subject: Aion Account Identification-NO.00154

Links to: www.ncsoft-aionsecurity.info

  • Received again:

Return-Path: djflowmstr@hotmail.com
Received: from vwklobwyz ([123.8.188.172]) by BLU0-SMTP37.blu0.hotmail.com over TLS secured channel with Microsoft SMTPSVC(6.0.3790.4675);
Sat, 31 Jul 2010 18:04:30 -0700
Reply-To: <support@ncsoft.com>
From: “support@ncsoft.com” <support@ncsoft.com>
To: <jayras@gmail.com>
Subject: Aion Account Issue-N0.0969

Links to: www.ncsoft-aionsecurity.us

Ͼ http://www.pthkm.com/xpjylc/ http://www.pthkm.com/bgylc/ Ͼֳ http://www.pthkm.com/pjylc/ ewinֳ http://www.ybewv.com/ewinylc/ Ŷij http://www.ybewv.com/amdc/ ˰ټ http://www.eklhp.com/zrbjl/ Ŷij http://www.aojxq.com/amdcgl/ bet http://www.lpmwq.com/bet365ylc/ ȫѶ http://www.wfgpb.com/qxwgw/ 188 http://www.ywiql.com/jbb188gq/ bet http://www.nwiza.com/bet365ylc/ 365 http://www.rvodp.com/bet365tyzx/ Ͼ http://www.yjzhv.com/smxpjgw/ Ͼij http://www.utssx.com/ampjdc/ ˹˶ij http://www.bkrft.com/amwnsrdc/ Ͼij http://www.bkrft.com/pjdc/ ƶij http://www.bkrft.com/yddc/ Ŷij淨 http://www.bkrft.com/amdcwf/ ȫѶ http://www.bkrft.com/qxwzx/ ˹ά˹ij http://www.fldwd.com/lswjsdc/ ζij http://www.fldwd.com/lwdc/ ŶijЩ http://www.fldwd.com/amdcynx/ ij http://www.fldwd.com/mddc/ ˹˶ij http://www.fldwd.com/wnsrdc/ Ͼij http://www.yuwew.com/amxpjdc/ ĥij http://www.yuwew.com/mddc/ ijϷ http://www.yuwew.com/dcyx/ ĥƽij http://www.yuwew.com/mdhjdc/ ĥij http://www.hgvnk.com/lwmddc/ Űټ http://www.hgvnk.com/ambjl/ ټϷ http://www.hgvnk.com/bjlyx/ ˰ټ http://www.hgvnk.com/zrbjl/ http://www.dnczv.com/bcw/ Ŷij http://www.ybewv.com/amdc/ ˰ټ http://www.eklhp.com/zrbjl/ ټ http://www.zytygb.com/baijiale/ Ŷij http://www.luyouren.com/amdc/ ֳ http://www.yjzhv.com/ozylc/ Ŷij http://www.luyouren.com/aomenduchan/ bet http://www.lsylnj.com/bet365/ Ŷij http://www.lsylnj.com/amdc/ ټ http://www.lsylnj.com/bjl/ http://www.lsylnj.com/bcw/ ˹ http://www.lsylnj.com/wnsrylc/ Ͼ http://www.lsylnj.com/xpjylc/ ټ http://www.zytygb.com/baijiale/ Ŷij http://www.luyouren.com/aomengdushang/ ewinֳ http://www.luyouren.com/ewinyulechen/ bet http://www.luyouren.com/bet365/ ټ http://www.luyouren.com/bjl/ Ŷij http://www.luyouren.com/amdc/ Ŷij http://www.luyouren.com/amduchan/ Ŷij http://www.luyouren.com/aomendc/ Ŷij http://www.luyouren.com/aomenduchan/ Ŷij http://www.luyouren.com/aomengdushang/ ewinֳ http://www.luyouren.com/ewinylc/ ewinֳ http://www.luyouren.com/ewinylchen/ ewinֳ http://www.luyouren.com/ewinylec/ ewinֳ http://www.luyouren.com/ewinyulc/ ewinֳ http://www.luyouren.com/ewinyulechen/ http://www.dnczv.com/bcw/ ټ http://www.dnczv.com/bjl/ bet http://www.dnczv.com/bet365/ ˹ http://www.pthkm.com/wnsrylc/