I just recieved an e-mail from "Blizzard" that managed to get into my inbox rather than spam with the title
"Return to World of Warcraft with 7 Days of Game Time".
It looks relatively convincing, but upon further investigation I found it to be fraud by looking at the full e-mail header:
From Blizzard Entertainment Thu Jul 7 04:29:56 2011
X-Apparently-To: [MY-EMAIL] via 98.137.26.146; Thu, 07 Jul 2011 04:29:54 -0700
Return-Path: <[email protected]>
Received-SPF: fail (domain of blizzard.com does not designate 112.175.245.48 as permitted sender)
X-YMailISG: blGXtlwWLDtnFoaO30.9FJwlk5vZv6gejZwg6LdO7Cz9biPc
Chj1EHRn4TQwbZyryNDy59IrEAmzAhWrr2e3tD3xqYrWYfxOBtoC8en5b8gP
PiFYOWAbLyxzcqLOI6rWWoMbRkjA0P8ufVo1rVa4uM4jTLURbFe2beK70vtr
fDA3jPhuiwLk0SX1f3tw4nI_4qx1kYMoVyqr1c9QiRFfjcpgRuOqm3DGHpG1
H4xxnDVmlViFFJxDCtHM.UwlLWW2s1kSfrXMjllIjPjIrKjJ6YKxa_z9rjmB
CT2vSzEJGGkdYnQld5PuzhLOxRnNUIr5HlZWCFSynAgW8HZWMcwAHV9tWwi3
rKV33vPwCW14jxSh7lJD5pTEvxS1QQUIIUf_UXos2eEf5rVEZ71SeDUgBQ.k
Qsei9BhB0cWwzLc051uGlPMIG74JAZLNf5mPBuRWjEOyBVnqjoOrsFA_PwTy
vaYowKXE5Rf8Bfr9GruuROkly2vKlVge7oogijQm6bdE_Oirlfz.frGA9PPh
_nph5GHHBDcD4xjJk9_NIFjIOM.B9jatG5g8nm9uxmOrkDy7Fu_9u8vw_CZj
mEvFoXFkpYDtVx5nRO2cjpfGwmIUlVvtiBPOMHFTSZug_ULn0iuB97HIEJOc
F0Nr.91LDzHIRPG7cFk6we8sUMYWcJEw0e1ber7F87EXcopcLf8zx9RhxUkB
UZGOKV4f5rSrjFMX.GfGl_av_P1skMTFVjiyDY0qhmf5tQiPDy3mHs_pXksv
x3O_VLkX7IsDrOkNipdctgE1esYapcwquxXt1I9K6slbjullKvtKDI.QeX4V
u0AgkXqrYdkfiEiM3d.QS5W.waEeIsvuHiMzcMIjbsrwsnQTuDABP8wxE8n2
Z46UjXu8T4V7l9DW1yTSX1xhL_tSCR.np8v2fzGSvrrfQNWRcA9y2FGPjx.a
q05K7fAZonMMUSxbqeqXbIT2ZxEW7qI_bieeDCLrQrdzeL6obFo8_ajHSTnZ
SV3KGXUzk6ZvywXHj.1.MyETggbxtZmoGHOZPifiShtei2XJ.Pd.W9j.QayM
1QmtKXlbP0prCjx.7e9bev2cWztVbDiDL8u4Lreq7fEYDh1ToZAylUv8Ag--
X-Originating-IP: [112.175.245.48]
Authentication-Results: mta126.mail.ac4.yahoo.com from=blizzard.com; domainkeys=neutral (no sig); from=blizzard.com; dkim=neutral (no sig)
Received: from 127.0.0.1 (EHLO blizzard.com) (112.175.245.48)
by mta126.mail.ac4.yahoo.com with SMTP; Thu, 07 Jul 2011 04:29:53 -0700
From: "Blizzard Entertainment" <[email protected]>
Subject: Return to World of Warcraft with 7 Days of Game Time
To: [MY-EMAIL]
Content-Type: text/html;charset="GB2312"
Content-Transfer-Encoding: 8bit
Date: Thu, 7 Jul 2011 19:29:56 +0800
X-Priority: 3
X-Mailer: Foxmail 4.1 [cn]
Content-Length: 28707
|
There are also a few clues in the e-mail itself such as the "Der" instead of "Dear." Also, it claims 4.2 to be "Rise of the Zalandari"
If you actually click the link it takes you to a site with a domain of ".tk" which is completely fake.
I hope nobody falls for this!
Edit: I attached an image of the e-mail.
Threaded Mode
