Thread Tools Display Modes
07-07-11, 07:53 AM   #1
Waky
A Cobalt Mageweaver
 
Waky's Avatar
AddOn Author - Click to view addons
Join Date: Aug 2010
Posts: 200
"Free 7 Days" Scam Warning

I just recieved an e-mail from "Blizzard" that managed to get into my inbox rather than spam with the title "Return to World of Warcraft with 7 Days of Game Time".
It looks relatively convincing, but upon further investigation I found it to be fraud by looking at the full e-mail header:
From Blizzard Entertainment Thu Jul 7 04:29:56 2011
X-Apparently-To: [MY-EMAIL] via 98.137.26.146; Thu, 07 Jul 2011 04:29:54 -0700
Return-Path: <[email protected]>
Received-SPF: fail (domain of blizzard.com does not designate 112.175.245.48 as permitted sender)
X-YMailISG: blGXtlwWLDtnFoaO30.9FJwlk5vZv6gejZwg6LdO7Cz9biPc
Chj1EHRn4TQwbZyryNDy59IrEAmzAhWrr2e3tD3xqYrWYfxOBtoC8en5b8gP
PiFYOWAbLyxzcqLOI6rWWoMbRkjA0P8ufVo1rVa4uM4jTLURbFe2beK70vtr
fDA3jPhuiwLk0SX1f3tw4nI_4qx1kYMoVyqr1c9QiRFfjcpgRuOqm3DGHpG1
H4xxnDVmlViFFJxDCtHM.UwlLWW2s1kSfrXMjllIjPjIrKjJ6YKxa_z9rjmB
CT2vSzEJGGkdYnQld5PuzhLOxRnNUIr5HlZWCFSynAgW8HZWMcwAHV9tWwi3
rKV33vPwCW14jxSh7lJD5pTEvxS1QQUIIUf_UXos2eEf5rVEZ71SeDUgBQ.k
Qsei9BhB0cWwzLc051uGlPMIG74JAZLNf5mPBuRWjEOyBVnqjoOrsFA_PwTy
vaYowKXE5Rf8Bfr9GruuROkly2vKlVge7oogijQm6bdE_Oirlfz.frGA9PPh
_nph5GHHBDcD4xjJk9_NIFjIOM.B9jatG5g8nm9uxmOrkDy7Fu_9u8vw_CZj
mEvFoXFkpYDtVx5nRO2cjpfGwmIUlVvtiBPOMHFTSZug_ULn0iuB97HIEJOc
F0Nr.91LDzHIRPG7cFk6we8sUMYWcJEw0e1ber7F87EXcopcLf8zx9RhxUkB
UZGOKV4f5rSrjFMX.GfGl_av_P1skMTFVjiyDY0qhmf5tQiPDy3mHs_pXksv
x3O_VLkX7IsDrOkNipdctgE1esYapcwquxXt1I9K6slbjullKvtKDI.QeX4V
u0AgkXqrYdkfiEiM3d.QS5W.waEeIsvuHiMzcMIjbsrwsnQTuDABP8wxE8n2
Z46UjXu8T4V7l9DW1yTSX1xhL_tSCR.np8v2fzGSvrrfQNWRcA9y2FGPjx.a
q05K7fAZonMMUSxbqeqXbIT2ZxEW7qI_bieeDCLrQrdzeL6obFo8_ajHSTnZ
SV3KGXUzk6ZvywXHj.1.MyETggbxtZmoGHOZPifiShtei2XJ.Pd.W9j.QayM
1QmtKXlbP0prCjx.7e9bev2cWztVbDiDL8u4Lreq7fEYDh1ToZAylUv8Ag--
X-Originating-IP: [112.175.245.48]
Authentication-Results: mta126.mail.ac4.yahoo.com from=blizzard.com; domainkeys=neutral (no sig); from=blizzard.com; dkim=neutral (no sig)
Received: from 127.0.0.1 (EHLO blizzard.com) (112.175.245.48)
by mta126.mail.ac4.yahoo.com with SMTP; Thu, 07 Jul 2011 04:29:53 -0700
From: "Blizzard Entertainment" <[email protected]>
Subject: Return to World of Warcraft with 7 Days of Game Time
To: [MY-EMAIL]
Content-Type: text/html;charset="GB2312"
Content-Transfer-Encoding: 8bit
Date: Thu, 7 Jul 2011 19:29:56 +0800
X-Priority: 3
X-Mailer: Foxmail 4.1 [cn]
Content-Length: 28707
There are also a few clues in the e-mail itself such as the "Der" instead of "Dear." Also, it claims 4.2 to be "Rise of the Zalandari"

If you actually click the link it takes you to a site with a domain of ".tk" which is completely fake.

I hope nobody falls for this!

Edit: I attached an image of the e-mail.
Attached Thumbnails
Click image for larger version

Name:	7dayScam.jpg
Views:	876
Size:	153.8 KB
ID:	6306  

Last edited by Waky : 07-07-11 at 08:01 AM.
  Reply With Quote
07-07-11, 10:00 AM   #2
Arxae
A Cyclonian
AddOn Author - Click to view addons
Join Date: Aug 2009
Posts: 44
Send a mail to blizzard with that info they sue them or something
Well at least they send you a thanks for reporting mail back xD
  Reply With Quote
07-07-11, 01:14 PM   #3
Cairenn
Credendo Vides
 
Cairenn's Avatar
Premium Member
WoWInterface Admin
Join Date: Mar 2004
Posts: 7,134
Thanks Waky, for posting the heads-up. The more people looking out for the good of the community the better.

As Arxae suggested, you should also send a note to [email protected] with the fake email attached, so they can take the appropriate steps.
__________________
“Do what you feel in your heart to be right — for you’ll be criticized anyway.” ~ Eleanor Roosevelt
~~~~~~~~~~~~~~~~~~~
Co-Founder & Admin: MMOUI
FaceBook Profile, Page, Group
Avatar Image by RaffaeleMarinetti
  Reply With Quote
07-07-11, 01:22 PM   #4
Poreo
A Warpwood Thunder Caller
Join Date: Nov 2010
Posts: 94
This one is obviously a scam, but there is a legit free 7 day thing too. I quit wow and uninstalled it. A week ago I installed it, and on battle.net , it prompted me to apply me free 7 days

Last edited by Poreo : 07-07-11 at 01:58 PM.
  Reply With Quote
07-07-11, 01:40 PM   #5
SDPhantom
A Pyroguard Emberseer
 
SDPhantom's Avatar
AddOn Author - Click to view addons
Join Date: Jul 2006
Posts: 2,313
A note to all players, at the very least, always check all links you receive, whether by e-mail, IM, etc. In most programs, you can do this by mouseovering (hovering your mouse over) the link. The program would either pop up a tooltip describing the link or show where it goes in the status bar at the bottom of the window. Do make sure this is the location you're expecting to go to and READ IT CAREFULLY. Many phishers prey on links that look as close to authentic as possible.
__________________
WoWInterface AddOns
"All I want is a pretty girl, a decent meal, and the right to shoot lightning at fools."
-Anders (Dragon Age: Origins - Awakening)
  Reply With Quote
07-08-11, 01:34 AM   #6
Zyonin
Coffee powered Kaldorei
 
Zyonin's Avatar
AddOn Author - Click to view addons
Join Date: May 2006
Posts: 1,443
I am in the habit of regarding any WoW related email with a large dose of suspicion. I have gotten several of those emails and always hit the "Delete" button.
__________________
Twitter
  Reply With Quote
07-09-11, 04:10 PM   #7
Poreo
A Warpwood Thunder Caller
Join Date: Nov 2010
Posts: 94
  Reply With Quote
07-09-11, 06:02 PM   #8
Waky
A Cobalt Mageweaver
 
Waky's Avatar
AddOn Author - Click to view addons
Join Date: Aug 2010
Posts: 200
Originally Posted by Poreo View Post
This one is obviously a scam, but there is a legit free 7 day thing too. I quit wow and uninstalled it. A week ago I installed it, and on battle.net , it prompted me to apply me free 7 days
I actually just used a real 7 day trial from Blizzard and got this e-mail soon after.


Originally Posted by Zyonin View Post
I am in the habit of regarding any WoW related email with a large dose of suspicion. I have gotten several of those emails and always hit the "Delete" button.
I love it when I get WoW Account Lock warnings on my other e-mail since my WoW account is on a different e-mail.

Last edited by Waky : 07-09-11 at 06:25 PM.
  Reply With Quote
07-09-11, 08:19 PM   #9
Petrah
A Pyroguard Emberseer
 
Petrah's Avatar
AddOn Author - Click to view addons
Join Date: Jan 2008
Posts: 2,988
The email address I use for my wow account has never been used for anything other than my wow account (no forums, personal emails, nothing. Blizz is the only company that has it). I get no wow spam at that address... but it's funny how I get the wow spam at every single other address I use lol. I don't even bother to open them. I just delete them and forget about em.
__________________
♪~ ( ) I My Sonos!
AddOn Authors: If your addon spams the chat box with "Addon v8.3.4.5.3 now loaded!", please add an option to disable it!
  Reply With Quote
07-10-11, 11:50 AM   #10
SDPhantom
A Pyroguard Emberseer
 
SDPhantom's Avatar
AddOn Author - Click to view addons
Join Date: Jul 2006
Posts: 2,313
Originally Posted by Petrah View Post
The email address I use for my wow account has never been used for anything other than my wow account (no forums, personal emails, nothing. Blizz is the only company that has it). I get no wow spam at that address... but it's funny how I get the wow spam at every single other address I use lol. I don't even bother to open them. I just delete them and forget about em.
same here
__________________
WoWInterface AddOns
"All I want is a pretty girl, a decent meal, and the right to shoot lightning at fools."
-Anders (Dragon Age: Origins - Awakening)
  Reply With Quote
07-10-11, 01:40 PM   #11
tenub
A Flamescale Wyrmkin
AddOn Author - Click to view addons
Join Date: Sep 2008
Posts: 111
Those crafty chinese scammers are getting better by the day! Oh well, at least they're still making e-mails ridden with typos and poor grammar. That's usually the dead giveaway for me..
  Reply With Quote
07-10-11, 03:26 PM   #12
Seerah
Fishing Trainer
 
Seerah's Avatar
WoWInterface Super Mod
Featured
Join Date: Oct 2006
Posts: 10,860
They're not always from a source in China... There are scammers all over the world.
__________________
"You'd be surprised how many people violate this simple principle every day of their lives and try to fit square pegs into round holes, ignoring the clear reality that Things Are As They Are." -Benjamin Hoff, The Tao of Pooh

  Reply With Quote
07-11-11, 12:15 AM   #13
Nibelheim
local roygbi-
 
Nibelheim's Avatar
AddOn Author - Click to view addons
Join Date: Jan 2010
Posts: 1,600
Originally Posted by Seerah View Post
They're not always from a source in China... There are scammers all over the world.
Yeppo.

making e-mails ridden with typos and poor grammar. That's usually the dead giveaway for me..
You have to wonder how many more people they'd get if they just spent 1 minute error checking their emails
  Reply With Quote
07-11-11, 02:10 AM   #14
Coote
A Scalebane Royal Guard
 
Coote's Avatar
AddOn Author - Click to view addons
Join Date: Apr 2007
Posts: 440
Originally Posted by Nibelheim View Post
You have to wonder how many more people they'd get if they just spent 1 minute error checking their emails
I shudder to imagine. You know it'd be somewhere around 3-5x as many at the very least.
__________________

"This is the fifteen-thousandth four hundredth and ninety-eighth occurence".
  Reply With Quote
07-12-11, 01:29 AM   #15
Zyonin
Coffee powered Kaldorei
 
Zyonin's Avatar
AddOn Author - Click to view addons
Join Date: May 2006
Posts: 1,443
Originally Posted by Waky View Post
I love it when I get WoW Account Lock warnings on my other e-mail since my WoW account is on a different e-mail.
What's really funny is I never see these emails on the account that is tied to my Battle.Net/WoW account. I do see them on the old account address that was tied to my WoW account however I changed that some ago. Still the spam keeps rolling in.
__________________
Twitter
  Reply With Quote
07-15-11, 06:49 PM   #16
Ferous
Sheer Sense of Doom
AddOn Author - Click to view addons
Join Date: Mar 2008
Posts: 863
I just got my free 7 days :P I don't plan to play further though... But I would be aware of frauds and such, and make sure you're not going to get hacked or what not.
  Reply With Quote
07-18-11, 07:57 AM   #17
Benea
A Deviate Faerie Dragon
AddOn Author - Click to view addons
Join Date: Dec 2005
Posts: 18
Originally Posted by Petrah View Post
The email address I use for my wow account has never been used for anything other than my wow account (no forums, personal emails, nothing. Blizz is the only company that has it). I get no wow spam at that address... but it's funny how I get the wow spam at every single other address I use lol. I don't even bother to open them. I just delete them and forget about em.
Same with me. Every other email I have is spammed with WoW stuff but not my actual blizzard account email.
  Reply With Quote
07-18-11, 11:13 AM   #18
bestwarrior
A Fallenroot Satyr
 
bestwarrior's Avatar
AddOn Author - Click to view addons
Join Date: Oct 2010
Posts: 20
i get these constantly..like my account is hacked or have been selling accounts, and also this. I just read them because usually the "people" that are typing them misspell something
__________________
Maker of Boda UI Revamped (Bestwarrior's UI)
Maker of Bestwarrior's UI

  Reply With Quote
07-18-11, 12:29 PM   #19
Coote
A Scalebane Royal Guard
 
Coote's Avatar
AddOn Author - Click to view addons
Join Date: Apr 2007
Posts: 440
Originally Posted by bestwarrior View Post
I just read them because usually the "people" that are typing them misspell something
Every now and then, you there's a gem in there that deserves to be sent to the lulzworthy folder.

For me, this was one of them.

__________________

"This is the fifteen-thousandth four hundredth and ninety-eighth occurence".
  Reply With Quote
07-18-11, 12:46 PM   #20
Cairenn
Credendo Vides
 
Cairenn's Avatar
Premium Member
WoWInterface Admin
Join Date: Mar 2004
Posts: 7,134
*chuckles*
  Reply With Quote

WoWInterface » General Discussion » General WoW Chat » "Free 7 Days" Fraud

Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

vB code is On
Smilies are On
[IMG] code is On
HTML code is Off