Phishing for WOW account passwords !

Alrik Fassbauer

TL;DR
Original Sin Donor
Original Sin 2 Donor
Joined
November 5, 2006
Messages
21,893
Location
Old Europe
Hello, everyone,

I received this email today. It's in my own lnguage, German.

Basically it's a Phishing attack for the password of my non-existend WOW Account.

It was sent by an E-Mail Adress called "lord_butcher_90@yahoo.co.uk"

The masked link leads to this place : http://www.streas-winged.tk/

Begruessung!

Wir haben bemerkt, dass Sie versuchen Ihre persoenlichen World of Warcraft-Account zu verkaufen.
Nutzungsbedingung

http://www.worldofwarcraft.com/legal/termsofuse.html
Die Blizzard Entertainment Mitarbeiter werden weiter untersuchen.
Wenn Sie nicht moechten, dass Ihren Account blockiert werden. Bitte ueberpruefen Sie sofort Ihren Accountsbesitzanspruch. Sie muessen die folgenden Schritte durchfuehren, um die Sicherheit Ihres Accounts und Computer zu gewaehrleisten.

Schritt 1. Account Untersuchung
Wir bieten Ihnen jetzt eine sichere Webseite, dadurch Sie ueberpruefen zu koennen, ob Sie die entsprechenden Massnahmen ergriffen, um die Sicherheit Ihres Accounts, Computers und E-Mail-Adresses zu gewaehrleisten. Bitte melden Sie sich auf der Web-Seite und bestaetigen Sie nach den Anweisungen:
http://eu.blizzard.com/support/article/securitywebform

Schritt 2. Stellen Sie sicher,dass die gegebene Informationen eingenommen ist.
Sobald verarbeiten wir Ihre gegebenen Informationen nach dem Empfang. Und kontaktieren Wir mit Ihnen um weitere Anweisung zu geben. Wenn Sie nach dem Absenden dieses Formulars innerhalb von 48 Stunden keine Antwort erhalten, bitte senden Sie nochmal das Formular an die oben angegebene Web-Seite.

Bitte beachten Sie! Wenn Ohne Akkreditierung dies Account zu besuchen, werden wir weitere Massnahmen zu ergreifen.

Begruessen Sie!

Kundenservice

And this is how it looks like in raw view (i just cut the whole header, because it contains my personal E-Mail - Adress as well) :

Please note that the masked link is NOT visible this way !

Date: Tue, 15 Jan 2013 18:27:25 +0800
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary="——=_NextPart_000_0158_01EA0A9F.1A8886D0"
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2900.5512
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.5512
Envelope-To:
X-GMX-Antispam: 0 (Mail was not recognized as spam); Detail=V3;
X-GMX-Antivirus: 0 (no virus found)
X-UI-Filterresults: ;V01:K0:t2F+5/vGe4c=:uQvhzieCKzwH0//c7ilNxfolC+EX3NV
Ry3YRZ12LJ1+VAMHkjNmZtdw8yw4u2iiKrEg06AT+N4IS8J5LJ6NEQW+EnII81e6VFRhHIx
1umRxN+AsFG7FoPJdZQHmPx5NCYMPVccLRYAtYoICJuWMLpzkuOnDIGICdrUER9SSVDCEKB
49A7m2kDbMip4we6xLVXQyGQhvRUjidqhvPD81rCDKR2uTFTkzawFaAOzFwd4RNIxGsThjO
fCFjZwAuE+34tqYoM6hn7nHgLCJzfSak95sp1dI9fh+1wZLJxNeu/FC0QO9wadfT1xjAvBX
JXyLOd4P57Ea/Ko4nwgNeOWsCMG1+izhTkEsgPKjCYg8FB3Dlz2sIn2LNbKuqYLEB+AikwV
3PesZeSi+R20I7KWxNtrQNuZK7PUI0QxC3mXLKUb046B4oZqc5n6KenuRxbE/FoUtePvnn4
P2qeeisPtLVygbQ0dIHPRyU1liMVAgu7K1trukE6G9e5t+9I0apWdZuipSNME8b5vynrhVR
eY3iHowFBgIrGCXbBf9cT3hF3xuvqMmb9qeagDrx2Uulc+syz1vsBdUZZeLKPqHds0Q20dQ
J4Ov/Gj507QTShFI+AXDSrCoXeO/shGr7V2HtCUFOfdAiLkeEPaX4fZVSdCP/FDvnBUzb/k
etFejHcATn83l1xSy8qT9zjYIdjInwSREBAeD+FVIxbMVgAIDqyE1XckZ1u/i5h48CtP+BN
2y3yZTbiqHKCPtXkIEOxZ2yIcdG/JmXPblRx6zWGAIX9rHxZmxKAqraXQOIw/sReYb0U3qJ
+D5In/Xdz8H5YcSMZDWwiXcHVYVmf8W3iuVHa52rDFWTY1xS8pJY7O8O71w1c1gZ192CSwI
mCCLpaGJgD059zOK9MirA0nCrxVzUGkNYAgeTHV9vPoEhEbAgWyXxSGH4G8QAzm6Fm/dvbp
LYVXInns6U9Myk21xVMl7Ejn8UUjhUdtK3K9Ww9rmHOX+YAgLCqtjz8Re1RxTNLNywAydfX
aFnjUpr5/NShHPlyAIUI11pe3HF8gL0rT/nevF4GHt+8atsKpYMr+z3gsYSs6ZkEFHOnfj4
DVimyppIm1Ff4RN+KhVLACNUHL8ineE6ybaLNbhagi4X45dEefxEIBa1HEzho5L46pt5+Cl
08zO0gMy7bAWZiakkslLZU+RVF1jsyxGVkL8KTW0DKaxAZsc+YJIcpKwQT1fI0cClbtRiiP
0C0U3eLi4Pb2KkxnoxOocnTa0yKz9HZhVAwt1mUq8EBKWVGXJVJhByH+vZ9RmN1NUZfFtFX
UuonWXhd+m4c/IRCD06wzS9KQN5S8Bm7wRFFUA6GEMc67w0cBK+nfKzGnUryjrFJm4cjkNy
D7rLejVpRDXoXYNTyyF7LG6qP35KciZeX/Ayts97TUXLgu/5c8uxzzDLowUh5aPHEbhp+sE
=
X-PMFLAGS: 570950080 0 1 PT4KYP3S.CNM

This is a multi-part message in MIME format.

———=_NextPart_000_0158_01EA0A9F.1A8886D0
Content-Type: text/plain;
charset="utf-8"
Content-Transfer-Encoding: base64

QmVncnVlc3N1bmchIA0KDQpXaXIgaGFiZW4gYmVtZXJrdCwgZGFzcyBTaWUgdmVyc3VjaGVuIElo
cmUgcGVyc29lbmxpY2hlbiBXb3JsZCBvZiBXYXJjcmFmdC1BY2NvdW50IHp1IHZlcmthdWZlbi4g
DQpOdXR6dW5nc2JlZGluZ3VuZyANCg0KaHR0cDovL3d3dy53b3JsZG9md2FyY3JhZnQuY29tL2xl
Z2FsL3Rlcm1zb2Z1c2UuaHRtbCANCkRpZSBCbGl6emFyZCBFbnRlcnRhaW5tZW50IE1pdGFyYmVp
dGVyIHdlcmRlbiB3ZWl0ZXIgdW50ZXJzdWNoZW4uIA0KV2VubiBTaWUgbmljaHQgbW9lY2h0ZW4s
IGRhc3MgSWhyZW4gQWNjb3VudCBibG9ja2llcnQgd2VyZGVuLiBCaXR0ZSB1ZWJlcnBydWVmZW4g
U2llIHNvZm9ydCBJaHJlbiBBY2NvdW50c2Jlc2l0emFuc3BydWNoLiBTaWUgbXVlc3NlbiBkaWUg
Zm9sZ2VuZGVuIFNjaHJpdHRlIGR1cmNoZnVlaHJlbiwgdW0gZGllIFNpY2hlcmhlaXQgSWhyZXMg
QWNjb3VudHMgdW5kIENvbXB1dGVyIHp1IGdld2FlaHJsZWlzdGVuLiANCg0KU2Nocml0dCAxLiBB
Y2NvdW50IFVudGVyc3VjaHVuZyANCldpciBiaWV0ZW4gSWhuZW4gamV0enQgZWluZSBzaWNoZXJl
IFdlYnNlaXRlLCBkYWR1cmNoIFNpZSB1ZWJlcnBydWVmZW4genUga29lbm5lbiwgb2IgU2llIGRp
ZSBlbnRzcHJlY2hlbmRlbiBNYXNzbmFobWVuIGVyZ3JpZmZlbiwgdW0gZGllIFNpY2hlcmhlaXQg
SWhyZXMgQWNjb3VudHMsIENvbXB1dGVycyB1bmQgRS1NYWlsLUFkcmVzc2VzIHp1IGdld2FlaHJs
ZWlzdGVuLiBCaXR0ZSBtZWxkZW4gU2llIHNpY2ggYXVmIGRlciBXZWItU2VpdGUgdW5kIGJlc3Rh
ZXRpZ2VuIFNpZSBuYWNoIGRlbiBBbndlaXN1bmdlbjogDQpodHRwOi8vZXUuYmxpenphcmQuY29t
L3N1cHBvcnQvYXJ0aWNsZS9zZWN1cml0eXdlYmZvcm0gDQoNClNjaHJpdHQgMi4gU3RlbGxlbiBT
aWUgc2ljaGVyLGRhc3MgZGllIGdlZ2ViZW5lIEluZm9ybWF0aW9uZW4gZWluZ2Vub21tZW4gaXN0
LiANClNvYmFsZCB2ZXJhcmJlaXRlbiB3aXIgSWhyZSBnZWdlYmVuZW4gSW5mb3JtYXRpb25lbiBu
YWNoIGRlbSBFbXBmYW5nLiBVbmQga29udGFrdGllcmVuIFdpciBtaXQgSWhuZW4gdW0gd2VpdGVy
ZSBBbndlaXN1bmcgenUgZ2ViZW4uIFdlbm4gU2llIG5hY2ggZGVtIEFic2VuZGVuIGRpZXNlcyBG
b3JtdWxhcnMgaW5uZXJoYWxiIHZvbiA0OCBTdHVuZGVuIGtlaW5lIEFudHdvcnQgZXJoYWx0ZW4s
IGJpdHRlIHNlbmRlbiBTaWUgbm9jaG1hbCBkYXMgRm9ybXVsYXIgYW4gZGllIG9iZW4gYW5nZWdl
YmVuZSBXZWItU2VpdGUuIA0KDQpCaXR0ZSBiZWFjaHRlbiBTaWUhIFdlbm4gT2huZSBBa2tyZWRp
dGllcnVuZyBkaWVzIEFjY291bnQgenUgYmVzdWNoZW4sIHdlcmRlbiB3aXIgd2VpdGVyZSBNYXNz
bmFobWVuIHp1IGVyZ3JlaWZlbi4gDQoNCkJlZ3J1ZXNzZW4gU2llISANCg0KS3VuZGVuc2Vydmlj
ZSANCkJsaXp6YXJkIEVudGVydGFpbm1lbnQgDQpodHRwOi8vd3d3LmJsaXp6YXJkLmNvbS9zdXBw
b3J0IA==

———=_NextPart_000_0158_01EA0A9F.1A8886D0
Content-Type: text/html;
charset="utf-8"
Content-Transfer-Encoding: base64

PCFET0NUWVBFIEhUTUwgUFVCTElDICItLy9XM0MvL0RURCBIVE1MIDQuMCBUcmFuc2l0aW9uYWwv
L0VOIj4NCjxIVE1MPjxIRUFEPg0KPE1FVEEgY29udGVudD0idGV4dG1sOyBjaGFyc2V0PXV0Zi04
IiBodHRwLWVxdWl2PUNvbnRlbnQtVHlwZT4NCjxNRVRBIG5hbWU9R0VORVJBVE9SIGNvbnRlbnQ9
Ik1TSFRNTCA4LjAwLjYwMDEuMTkzOTMiPjwvSEVBRD4NCjxCT0RZPkJlZ3J1ZXNzdW5nISA8QlI+
PEJSPldpciBoYWJlbiBiZW1lcmt0LCBkYXNzIFNpZSB2ZXJzdWNoZW4gSWhyZSANCnBlcnNvZW5s
aWNoZW4gV29ybGQgb2YgV2FyY3JhZnQtQWNjb3VudCB6dSB2ZXJrYXVmZW4uIDxCUj5OdXR6dW5n
c2JlZGluZ3VuZyANCjxCUj48QlI+PEEgDQpocmVmPSJodHRwOi8vd3d3Lndvcmxkb2Z3YXJjcmFm
dC5jb20vbGVnYWwvdGVybXNvZnVzZS5odG1sIj5odHRwOi8vd3d3Lndvcmxkb2Z3YXJjcmFmdC5j
b20vbGVnYWwvdGVybXNvZnVzZS5odG1sPC9BPiANCjxCUj5EaWUgQmxpenphcmQgRW50ZXJ0YWlu
bWVudCBNaXRhcmJlaXRlciB3ZXJkZW4gd2VpdGVyIHVudGVyc3VjaGVuLiA8QlI+V2VubiANClNp
ZSBuaWNodCBtb2VjaHRlbiwgZGFzcyBJaHJlbiBBY2NvdW50IGJsb2NraWVydCB3ZXJkZW4uIEJp
dHRlIHVlYmVycHJ1ZWZlbiBTaWUgDQpzb2ZvcnQgSWhyZW4gQWNjb3VudHNiZXNpdHphbnNwcnVj
aC4gU2llIG11ZXNzZW4gZGllIGZvbGdlbmRlbiBTY2hyaXR0ZSANCmR1cmNoZnVlaHJlbiwgdW0g
ZGllIFNpY2hlcmhlaXQgSWhyZXMgQWNjb3VudHMgdW5kIENvbXB1dGVyIHp1IGdld2FlaHJsZWlz
dGVuLiANCjxCUj48QlI+U2Nocml0dCAxLiBBY2NvdW50IFVudGVyc3VjaHVuZyA8QlI+V2lyIGJp
ZXRlbiBJaG5lbiBqZXR6dCBlaW5lIHNpY2hlcmUgDQpXZWJzZWl0ZSwgZGFkdXJjaCBTaWUgdWVi
ZXJwcnVlZmVuIHp1IGtvZW5uZW4sIG9iIFNpZSBkaWUgZW50c3ByZWNoZW5kZW4gDQpNYXNzbmFo
bWVuIGVyZ3JpZmZlbiwgdW0gZGllIFNpY2hlcmhlaXQgSWhyZXMgQWNjb3VudHMsIENvbXB1dGVy
cyB1bmQgDQpFLU1haWwtQWRyZXNzZXMgenUgZ2V3YWVocmxlaXN0ZW4uIEJpdHRlIG1lbGRlbiBT
aWUgc2ljaCBhdWYgZGVyIFdlYi1TZWl0ZSB1bmQgDQpiZXN0YWV0aWdlbiBTaWUgbmFjaCBkZW4g
QW53ZWlzdW5nZW46IDxCUj48QSANCmhyZWY9Imh0dHA6Ly93d3cuc3RyZWFzLXdpbmdlZC50ayI+
aHR0cDovL2V1LmJsaXp6YXJkLmNvbS9zdXBwb3J0L2FydGljbGUvc2VjdXJpdHl3ZWJmb3JtPC9B
PiANCjxCUj48QlI+U2Nocml0dCAyLiBTdGVsbGVuIFNpZSBzaWNoZXIsZGFzcyBkaWUgZ2VnZWJl
bmUgSW5mb3JtYXRpb25lbiANCmVpbmdlbm9tbWVuIGlzdC4gPEJSPlNvYmFsZCB2ZXJhcmJlaXRl
biB3aXIgSWhyZSBnZWdlYmVuZW4gSW5mb3JtYXRpb25lbiBuYWNoIA0KZGVtIEVtcGZhbmcuIFVu
ZCBrb250YWt0aWVyZW4gV2lyIG1pdCBJaG5lbiB1bSB3ZWl0ZXJlIEFud2Vpc3VuZyB6dSBnZWJl
bi4gV2VubiANClNpZSBuYWNoIGRlbSBBYnNlbmRlbiBkaWVzZXMgRm9ybXVsYXJzIGlubmVyaGFs
YiB2b24gNDggU3R1bmRlbiBrZWluZSBBbnR3b3J0IA0KZXJoYWx0ZW4sIGJpdHRlIHNlbmRlbiBT
aWUgbm9jaG1hbCBkYXMgRm9ybXVsYXIgYW4gZGllIG9iZW4gYW5nZWdlYmVuZSANCldlYi1TZWl0
ZS4gPEJSPjxCUj5CaXR0ZSBiZWFjaHRlbiBTaWUhIFdlbm4gT2huZSBBa2tyZWRpdGllcnVuZyBk
aWVzIEFjY291bnQgenUgDQpiZXN1Y2hlbiwgd2VyZGVuIHdpciB3ZWl0ZXJlIE1hc3NuYWhtZW4g
enUgZXJncmVpZmVuLiA8QlI+PEJSPkJlZ3J1ZXNzZW4gU2llISANCjxCUj48QlI+S3VuZGVuc2Vy
dmljZSA8QlI+QmxpenphcmQgRW50ZXJ0YWlubWVudCA8QlI+PEEgDQpocmVmPSJodHRwOi8vd3d3
LmJsaXp6YXJkLmNvbS9zdXBwb3J0Ij5odHRwOi8vd3d3LmJsaXp6YXJkLmNvbS9zdXBwb3J0PC9B
PiANCjwvQk9EWT48L0hUTUw+DQo=

———=_NextPart_000_0158_01EA0A9F.1A8886D0—
 
Joined
Nov 5, 2006
Messages
21,893
Location
Old Europe
I have been getting those for years. I also get them about my "Diablo III Account" which I have never had.

Best to never click links in emails about accounts you have with any game. They all have account sections you can access by logging in for your self. If there is an issue you can find out that way.
 
Joined
Oct 18, 2006
Messages
2,384
Location
Missouri USA
Perhaps ... now that the U.S. area is probably "abgephisht" (German-English word game, roughly meaning : "fished off" and, as a consequence, empty due to too much fishing), perhaps they are now turning towards E.U. ?
I wonder because this is the very first one I get since many, many years.
 
Joined
Nov 5, 2006
Messages
21,893
Location
Old Europe
Ah yes, got one of these recently, too, just that they didn't specify any game (my BattleNet account), and the addy was a different one. Tsk tsk.
 
Joined
Aug 31, 2006
Messages
3,754
Personally I think the assholes just phish out their "lists" of potentials and then sell the list to someone else. It seems to come every six months or so.
 
Joined
Oct 18, 2006
Messages
2,384
Location
Missouri USA
Impressive.

I once read that someone opened up an Apple Store in China - only that it was never licensed by Apple.
Thy just copied everything.
 
Joined
Nov 5, 2006
Messages
21,893
Location
Old Europe
Impressive.

I once read that someone opened up an Apple Store in China - only that it was never licensed by Apple.
Thy just copied everything.

Haha yeah that one was a little bit more widespread than just someone opening one fake store. Chinese Authorities found 22 fake apple stores in just one Chinese city. The thing I find really interesting about this story though is that there were 0 real Apple Stores in that city, yet 22 fake ones were able to operate with quite a bit of business. That tells me maybe Apple is pretty aweful at figuring out where to expand and should seek out successful fake Apple Stores and buy out their location and staff rather than sue - at least rather than suing all of them.

There's also a fake Disney Land, but it went out of business and is now more of a depressing post-apocalyptic version instead of a believable fake.
 
Joined
Nov 20, 2006
Messages
1,710
I get e-mails like that for my bank account, ebay, facebook, and any number of other services that I use or don't use. At this point if I ever got a legitimate e-mail about a real problem with something, I'd completely ignore it and assume it was fake.
 
Joined
Apr 14, 2011
Messages
2,163
How bout e-mails about that wealthy prince that is willing to share his fortune if you either send money to help him back to his country or spend for the transaction fees? Completely bogus.
 
Joined
Feb 6, 2013
Messages
34
Joined
Nov 5, 2006
Messages
21,893
Location
Old Europe
Back
Top Bottom