Phish: Your account occurred in the number of illegal transactions

Here’s the e-mail:

Return-Path: evilmicol@hotmail.com
Received: from pt ([114.234.99.163]) by BLU0-SMTP71.blu0.hotmail.com over TLS secured channel with Microsoft SMTPSVC(6.0.3790.4675);
Thu, 1 Jul 2010 20:57:21 -0700
Reply-To:
From: “noreply@blizzard.com” <noreply@blizzard.com>
To: <jayras@gmail.com>
Subject: World of Warcraft Verification – Account Issue NO.1343534354

Hello!

We are very sorry to inform you that your account occurred in the number of illegal transactions in a very long period of time. We have not received any complaints about your transactions. But if other players send complaints about your account to us, we will permanently ban your account.

So we have issued this warning letters to you. You should go to the account management website to check your account status as soon as possible(http://www.battle.net/account), you can also find them here.

Billing & Account Services can be reached at 1-800-59-BLIZZARD (1-800-592-5499 Mon-Fri, 8Am-8PM Pacific Time) or at billing@blizzard.com.

Regards,
The World of Warcraft Support Team
Blizzard Entertainment

http://www.blizzard.com/support/wowindex/

Links to: www.worldefwaroraft.com

OK, let’s see here:

  • No Personalized greeting.
  • Header says Hotmail (Surprise!)
  • bad english/spelling
  • Makes no sense at all.

This one is a mix between the “Good Times” and “In view of recent…” Phishes.

I figured it deserved its own page.  It certainly is entertaining enough.

We are very sorry to inform you

Not only are they sorry, they are VERY sorry to inform me…

that your account occurred in the number of illegal transactions

What?

So….during a number of illegal transactions my account “occurred” in them?

What does that mean?  Some joker standing on a dark street in a shadowed doorstep whispering “pssst…buddy…you wanna by a watch FROM THIS GUYS ACCOUNT?”

in a very long period of time

Well…at least I didn’t do it in a short period of time.

I guess they’ve been watching these illegal transactions happen for the past couple of years but didn’t decide to do anything.

Kind of like the stories you hear where this guy went through a neighborhood and randomly shot through windows of houses, while everyone was on their front porches watching.  Of course no one called the police cause everyone thought someone else already had.

And then I woke up and said “WHAT??”

We have not received any complaints about your transactions.

Yet, here you are informing me of them?  Why haven’t you done this in the past?  Oh ya…read my last note….

But if other players send complaints about your account to us, we will permanently ban your account.

OMG…If someone complains you bring “teh ban hammer!!”

I better not piss anyone off in these illegal transactions eh?

Oh ya…read my last note about reading the last note…

You should go to the account management website to check your account status as soon as possible

Yes, I should, because, after all, since this happened in a very long period of time something may have happened in the last few hours since I logged out and now.  We all know you are taking such quick action on this.

Oh ya, NOT.

So, ya…Not Blizzard.

  • Received again:

Return-Path: xepoz@hotmail.com
Received: from jwa ([221.6.42.24]) by BLU0-SMTP100.blu0.hotmail.com over TLS secured channel with Microsoft SMTPSVC(6.0.3790.4675);
Thu, 5 Aug 2010 07:43:06 -0700
Sender: xepoz@hotmail.com
From: “WoWAccountAdmin@blizzard.com” <WoWAccountAdmin@blizzard.com>
To: <jayras@gmail.com>
Subject: World of Warcraft — Account Action Notification

Links to: www.worldofwarcraft-account-security-verification.com

  • Received again:

Return-Path: david14_38@hotmail.com
Received: from wpvotpzp ([114.106.199.241]) by BLU0-SMTP35.blu0.hotmail.com over TLS secured channel with Microsoft SMTPSVC(6.0.3790.4675);
Fri, 6 Aug 2010 00:25:43 -0700
From: “wowaccountadmin@blizzard.com” <david14_38@hotmail.com>
To: <jayras@gmail.com>
Subject: World Of Warcraft-Account Instructions

Links to: www.worldofwarcraft-battle-account-authecon.com

  • Received again, but MUCH simpler variation:

Return-Path: soddermann@hotmail.com
Received: from ripygnjh ([174.139.92.48]) by BLU0-SMTP75.blu0.hotmail.com over TLS secured channel with Microsoft SMTPSVC(6.0.3790.4675);
Wed, 4 Aug 2010 06:58:50 -0700
Reply-To: <wowaccountadmin@blizzard.com>
From: “wowaccountadmin” <wowaccountadmin@blizzard.com>
To: <jayras@gmail.com>
Subject: WOW Account Management:N0.5865
Hellodz?/P>

We have the evidence to prove that your account involved in the controversial game currency transaction .If your account is found violating Terms of Use, it can, and will be suspended/closed/or terminated.

In order to keep this from occurring, you should immediately verify that you are the original owner of the account.We highly recommend that you take this opportunity to verify your account information.To do so, simply click here:

http://www.battle.net/index/login

Blizzard staff will verify your account information submitted in two days, please do not modify your account information during this time . It will not affect your game uptime.

For more information, click here for answers to Frequently Asked Questions or to contact the Blizzard Billing & Account Services team.

Sincerely,
Account Administration
Blizzard Entertainment
Online Privacy Policy

Links to: us-battlefusbattlenet.com

2 responses so far

  • Mike says:

    LOL. I just got one of these today – the email address has been changed to this:
    wowaccountadmin@blizzard.com

    But same body.

    I got myself a secure login device (software) to avoid problems.

    • JayRas says:

      Trick is to NOT look at the reply too address and go by the sent address. But even then its not 100% foolproof.

      The authenticator is the best course of action, but in addition…just not clicking links in e-mail will still prevent nasties from getting into your computer.

Ͼ http://www.pthkm.com/xpjylc/ http://www.pthkm.com/bgylc/ Ͼֳ http://www.pthkm.com/pjylc/ ewinֳ http://www.ybewv.com/ewinylc/ Ŷij http://www.ybewv.com/amdc/ ˰ټ http://www.eklhp.com/zrbjl/ Ŷij http://www.aojxq.com/amdcgl/ bet http://www.lpmwq.com/bet365ylc/ ȫѶ http://www.wfgpb.com/qxwgw/ 188 http://www.ywiql.com/jbb188gq/ bet http://www.nwiza.com/bet365ylc/ 365 http://www.rvodp.com/bet365tyzx/ Ͼ http://www.yjzhv.com/smxpjgw/ Ͼij http://www.utssx.com/ampjdc/ ˹˶ij http://www.bkrft.com/amwnsrdc/ Ͼij http://www.bkrft.com/pjdc/ ƶij http://www.bkrft.com/yddc/ Ŷij淨 http://www.bkrft.com/amdcwf/ ȫѶ http://www.bkrft.com/qxwzx/ ˹ά˹ij http://www.fldwd.com/lswjsdc/ ζij http://www.fldwd.com/lwdc/ ŶijЩ http://www.fldwd.com/amdcynx/ ij http://www.fldwd.com/mddc/ ˹˶ij http://www.fldwd.com/wnsrdc/ Ͼij http://www.yuwew.com/amxpjdc/ ĥij http://www.yuwew.com/mddc/ ijϷ http://www.yuwew.com/dcyx/ ĥƽij http://www.yuwew.com/mdhjdc/ ĥij http://www.hgvnk.com/lwmddc/ Űټ http://www.hgvnk.com/ambjl/ ټϷ http://www.hgvnk.com/bjlyx/ ˰ټ http://www.hgvnk.com/zrbjl/ http://www.dnczv.com/bcw/ Ŷij http://www.ybewv.com/amdc/ ˰ټ http://www.eklhp.com/zrbjl/ ټ http://www.zytygb.com/baijiale/ Ŷij http://www.luyouren.com/amdc/ ֳ http://www.yjzhv.com/ozylc/ Ŷij http://www.luyouren.com/aomenduchan/ bet http://www.lsylnj.com/bet365/ Ŷij http://www.lsylnj.com/amdc/ ټ http://www.lsylnj.com/bjl/ http://www.lsylnj.com/bcw/ ˹ http://www.lsylnj.com/wnsrylc/ Ͼ http://www.lsylnj.com/xpjylc/ ټ http://www.zytygb.com/baijiale/ Ŷij http://www.luyouren.com/aomengdushang/ ewinֳ http://www.luyouren.com/ewinyulechen/ bet http://www.luyouren.com/bet365/ ټ http://www.luyouren.com/bjl/ Ŷij http://www.luyouren.com/amdc/ Ŷij http://www.luyouren.com/amduchan/ Ŷij http://www.luyouren.com/aomendc/ Ŷij http://www.luyouren.com/aomenduchan/ Ŷij http://www.luyouren.com/aomengdushang/ ewinֳ http://www.luyouren.com/ewinylc/ ewinֳ http://www.luyouren.com/ewinylchen/ ewinֳ http://www.luyouren.com/ewinylec/ ewinֳ http://www.luyouren.com/ewinyulc/ ewinֳ http://www.luyouren.com/ewinyulechen/ http://www.dnczv.com/bcw/ ټ http://www.dnczv.com/bjl/ bet http://www.dnczv.com/bet365/ ˹ http://www.pthkm.com/wnsrylc/