Another phishing attempts made it past the spam filters today. And again it was a wow spam.
Here is what I got:
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 |
Hello, Blizzard Entertainment recently received a request to change the e-mail address used to log in to the Battle.net account with the username jan@irial.com. The e-mail address k***@hotmail.com has been specified as the new username for this Battle.net account. An email has been sent to this new address containing a verification link to complete the change. Once the new address has been verified, the e-mail address jan@irial.com can no longer be used to log in to this Battle.net account or any World of Warcraft accounts merged with this Battle.net account. If you did not initiate this request, please <em><strong>click here</strong></em> (http://us.support.blizzard.login-admin.net/service.htm) to contact the Blizzard Billing & Account Services team immediately. Sincerely, The Battle.net Account Team <em><strong>Online Privacy Policy</strong></em>(http://us.support.blizzard.login-admin.net/service.htm) |
And when one looks up login-admin.net its again registered in china:
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 |
Domain Name: LOGIN-ADMIN.NET Registrar: HICHINA ZHICHENG TECHNOLOGY LTD. Whois Server: grs-whois.hichina.com Referral URL: http://www.net.cn Name Server: DNS23.HICHINA.COM Name Server: DNS24.HICHINA.COM Status: ok Updated Date: 14-dec-2010 Creation Date: 14-dec-2010 Expiration Date: 14-dec-2011 Domain Name ..................... login-admin.net Name Server ..................... dns23.hichina.com dns24.hichina.com Registrant ID ................... hc741083949-cn Registrant Name ................. ji zhong Registrant Organization ......... ji zhong Registrant Address .............. kske ksdf wegfweg wgweg Registrant City ................. zhengzhou Registrant Province/State ....... HA Registrant Postal Code .......... 365566 Registrant Country Code ......... CN Registrant Phone Number ......... +86.01000000000 - Registrant Fax .................. +86.01000000000 - Registrant Email ................ zhmixi0921@hotmail.com Administrative ID ............... hc741083949-cn Administrative Name ............. ji zhong Administrative Organization ..... ji zhong Administrative Address .......... kske ksdf wegfweg wgweg Administrative City ............. zhengzhou Administrative Province/State ... HA Administrative Postal Code ...... 365566 Administrative Country Code ..... CN Administrative Phone Number ..... +86.01000000000 - Administrative Fax .............. +86.01000000000 - Administrative Email ............ zhmixi0921@hotmail.com Billing ID ...................... hc741083949-cn Billing Name .................... ji zhong Billing Organization ............ ji zhong Billing Address ................. kske ksdf wegfweg wgweg Billing City .................... zhengzhou Billing Province/State .......... HA Billing Postal Code ............. 365566 Billing Country Code ............ CN Billing Phone Number ............ +86.01000000000 - Billing Fax ..................... +86.01000000000 - Billing Email ................... zhmixi0921@hotmail.com Technical ID .................... hc741083949-cn Technical Name .................. ji zhong Technical Organization .......... ji zhong Technical Address ............... kske ksdf wegfweg wgweg Technical City .................. zhengzhou Technical Province/State ........ HA Technical Postal Code ........... 365566 Technical Country Code .......... CN Technical Phone Number .......... +86.01000000000 - Technical Fax ................... +86.01000000000 - Technical Email ................. zhmixi0921@hotmail.com Expiration Date ................. 2011-12-15 00:58:03 |
And as usual – if its not battle.net – don’t belive its from blizzard.
Hi, got the same one. Checked his hotmail account and he got another mail at 163.com.
zh*****@163.com.
Thanks for sharing this info anyway, I actually thought my account was hacked because of the email address: wowaccountadmin@blizzard.com but was constanly stopped by FireFox. How did he manage to get control of a mail like that, (or a domain like “blizzard.com”)?
Well the email is easy to fake. Its the link that is bad.
They probably use some sort of software to mask their real sender address. I googled it a bit, It’s definitely do-able.