Phish: Good Times

Here’s the e-mail:

Return-Path: himonster93@hotmail.com
Received: from fqawsq ([60.19.160.40]) by BLU0-SMTP7.blu0.hotmail.com over TLS secured channel with Microsoft SMTPSVC(6.0.3790.4675);
Fri, 14 May 2010 18:06:28 -0700
From: “wowaccountadmin@blizzard.com” <donotrelpy@blizzard.com>
To: <jayras@gmail.com>
Subject: Account disable notification

When you receive this letter we are reviewing your account.
We have reason to believe that you have participated the illegal business.
To obtain further information, please help us.
Please visit [Misspelled Domain]
complete a questionnaire.
If you refuse to cooperate we will be in 48Hours after your account status changes to disable.

OK, let’s see here…

  • Header says it’s from Hotmail (Hi Monster 93 no less.)
  • Not personalized.
  • Poor English and Spelling
  • Bad phrasing
  • Ridiculous premise.

I’m calling this the “Good Time Phish”

In reference to the old “Good Times Virus” from way back.

When you receive this letter we are reviewing your account.

OK, so if I didn’t receive this, does that mean you won’t be reviewing my account?

We have reason to believe that you have participated the illegal business.

[Insert in strong, loud dramatic chords]

duh duh duh…

GASP

The Illegal Business

I have participated it

To obtain further information, please help us.

Oh wow…

“Hello sir, this is your local police department, we are calling you because we think you have participated the illegal business, can you give us further information please?”

DUDE…this ain’t Dragnet…real criminals just won’t confess to you, no matter how monotone your voice is.

Please visit [Misspelled Domain] complete a questionnaire.

Ummm….what is this?  Some kind of high pressure sales technique to get me to fill out a survey?

If you refuse to cooperate we will be in 48Hours after your account status changes to disable.

Wait, if I don’t fill out the survey

And I disable my account

2 days later you will be in?

or if I refuse to cooperate you’re threatening to be in the next 48Hours movie?

OK…so…Not Blizzard.

Update:

Received Again, although slight variant…

Return-Path: branmerlin@hotmail.com
Received: from ltsumo ([60.19.161.97]) by BLU0-SMTP100.blu0.hotmail.com over TLS secured channel with Microsoft SMTPSVC(6.0.3790.4675);
Tue, 25 May 2010 10:57:14 -0700
From: “wowaccountadmin@blizzard.com” <donotrelpy@blizzard.com>
To: <jayras@gmail.com>
Subject: Account disable Notification

When you receive this letter to mean that your account will be disabled within 48 hours.
this time disable your account is permanent.
Because we have evidence You have violated the involved in the offline for real money transactions.
If you have any questions please visit www.worldofwarcarft.com

This time I’ve violated the involved in the offline for real money transactions.

Because offline there is fake money that I can’t violate…

Wait…

violated

the involved

in the offline

for real money

transaction

Logic tree is a dead tree growing in 8 dimension?

Ͼ http://www.pthkm.com/xpjylc/ http://www.pthkm.com/bgylc/ Ͼֳ http://www.pthkm.com/pjylc/ ewinֳ http://www.ybewv.com/ewinylc/ Ŷij http://www.ybewv.com/amdc/ ˰ټ http://www.eklhp.com/zrbjl/ Ŷij http://www.aojxq.com/amdcgl/ bet http://www.lpmwq.com/bet365ylc/ ȫѶ http://www.wfgpb.com/qxwgw/ 188 http://www.ywiql.com/jbb188gq/ bet http://www.nwiza.com/bet365ylc/ 365 http://www.rvodp.com/bet365tyzx/ Ͼ http://www.yjzhv.com/smxpjgw/ Ͼij http://www.utssx.com/ampjdc/ ˹˶ij http://www.bkrft.com/amwnsrdc/ Ͼij http://www.bkrft.com/pjdc/ ƶij http://www.bkrft.com/yddc/ Ŷij淨 http://www.bkrft.com/amdcwf/ ȫѶ http://www.bkrft.com/qxwzx/ ˹ά˹ij http://www.fldwd.com/lswjsdc/ ζij http://www.fldwd.com/lwdc/ ŶijЩ http://www.fldwd.com/amdcynx/ ij http://www.fldwd.com/mddc/ ˹˶ij http://www.fldwd.com/wnsrdc/ Ͼij http://www.yuwew.com/amxpjdc/ ĥij http://www.yuwew.com/mddc/ ijϷ http://www.yuwew.com/dcyx/ ĥƽij http://www.yuwew.com/mdhjdc/ ĥij http://www.hgvnk.com/lwmddc/ Űټ http://www.hgvnk.com/ambjl/ ټϷ http://www.hgvnk.com/bjlyx/ ˰ټ http://www.hgvnk.com/zrbjl/ http://www.dnczv.com/bcw/ Ŷij http://www.ybewv.com/amdc/ ˰ټ http://www.eklhp.com/zrbjl/ ټ http://www.zytygb.com/baijiale/ Ŷij http://www.luyouren.com/amdc/ ֳ http://www.yjzhv.com/ozylc/ Ŷij http://www.luyouren.com/aomenduchan/ bet http://www.lsylnj.com/bet365/ Ŷij http://www.lsylnj.com/amdc/ ټ http://www.lsylnj.com/bjl/ http://www.lsylnj.com/bcw/ ˹ http://www.lsylnj.com/wnsrylc/ Ͼ http://www.lsylnj.com/xpjylc/ ټ http://www.zytygb.com/baijiale/ Ŷij http://www.luyouren.com/aomengdushang/ ewinֳ http://www.luyouren.com/ewinyulechen/ bet http://www.luyouren.com/bet365/ ټ http://www.luyouren.com/bjl/ Ŷij http://www.luyouren.com/amdc/ Ŷij http://www.luyouren.com/amduchan/ Ŷij http://www.luyouren.com/aomendc/ Ŷij http://www.luyouren.com/aomenduchan/ Ŷij http://www.luyouren.com/aomengdushang/ ewinֳ http://www.luyouren.com/ewinylc/ ewinֳ http://www.luyouren.com/ewinylchen/ ewinֳ http://www.luyouren.com/ewinylec/ ewinֳ http://www.luyouren.com/ewinyulc/ ewinֳ http://www.luyouren.com/ewinyulechen/ http://www.dnczv.com/bcw/ ټ http://www.dnczv.com/bjl/ bet http://www.dnczv.com/bet365/ ˹ http://www.pthkm.com/wnsrylc/