Account Offense: Violation of EULA and Terms of Service - Transfer of Account Ownership
Details: An investigation of your World of Warcraft account has found strong evidence that the account in question is being sold or traded. In accordance with EULA section 4, Paragraph B, listed below:
[...]
**In order to prevent an elongated suspension, we request that you verify your legitimate ownership of the account here:
[URL deleted] It looks like it goes to 'us.battle.net', but checking shows that it actually goes to 'batlle.freehostia.com'
> Account Offense: Violation of EULA and Terms of Service - Transfer of > Account Ownership
> Details: An investigation of your World of Warcraft account has found > strong evidence that the account in question is being sold or traded. > In accordance with EULA section 4, Paragraph B, listed below:
> [...]
> **In order to prevent an elongated suspension, we request that you > verify your legitimate ownership of the account here:
> [URL deleted] > It looks like it goes to 'us.battle.net', but checking shows that it > actually goes to 'batlle.freehostia.com'
> [....]
> So be on the lookout!
> pt
got from "clever" scundrel too (including headers what help to trace and locate theves):
Received: from unknown.altushost.com ([91.214.45.4]:26660 "EHLO M032" rhost-flags-OK-FAIL-OK-FAIL) by ps24.mod5.onet with ESMTPS id S939709496AbZFVTZk5zGdD; Mon, 22 Jun 2009 21:25:40 +0200 Received: from nodmaile by M032 with local (Exim 4.69) (envelope-from <em...@domain.com>) id 1MIp99-0004n5-TA for szpa...@poczta.onet.pl; Mon, 22 Jun 2009 21:25:39 +0200 From: <em...@domain.com> To: szpa...@poczta.onet.pl Subject: ***NOTICE OF FINAL WARNING*** Content-type: text/html; charset=iso-8859-1 Illegal-Object: Syntax error in From: address found on ps24.mod5.onet: From: nore...@blizzard.com<nore...@blizzard.com> ^-missing end of mailbox Message-Id: <E1MIp99-0004n5-TA@M032> Date: Mon, 22 Jun 2009 21:25:39 +0200 X-AntiAbuse: This header was added to track abuse, please include it with any abuse report X-AntiAbuse: Primary Hostname - M032 X-AntiAbuse: Original Domain - poczta.onet.pl X-AntiAbuse: Originator/Caller UID/GID - [552 552] / [47 12] X-AntiAbuse: Sender Address Domain - domain.com X-ONET_PL-MDA-Version: 1002 12270-110 (2009-05-20 16:04:22 CEST) X-ONET_PL-MDA-Info: 024 20412 00093 0.498475 X-ONET_PL-MDA-From: em...@domain.com X-ONET_PL-MDA-Spam: NO X-ONET_PL-MDA-Virus: NO X-Antivirus: avast! (VPS 090621-0, 2009-06-21), Inbound message X-Antivirus-Status: Clean
***NOTICE OF FINAL WARNING***<br><br>
Account Action: 3 Hour Suspension<br><br> Account Offense: Violation of EULA and Terms of Service - Transfer of Account Ownership <br><br> Details: An investigation of your World of Warcraft account has found strong evidence that the account in question is being sold or traded. In accordance with EULA section 4, Paragraph B, listed below:<br><br> <a href=http://www.worldofwarcraft.com/legal/eula.html target="_blank"> World of Warcraft -> Legal -> End User License Agreement </a> <br><br> and Section 8 of the Terms of Use: <br><br> <a href=http://www.worldofwarcraft.com/legal/termsofuse.htmltarget="_blank"> Blizzard Entertainment -> Legal -> Terms of Use</a><br><br>A 3-hour probationary suspension is pending on this account, awaiting confirmation from a specialist. A final warning has been issued. The investigation will be continued by the Account Administration team to determine the any further suspensions. If the account in question is found in violation of the EULA and Terms of Use, further action will be taken. Be aware that any additional inappropriate actions may result in the permanent closure of the account. <br><br> Thank you for respecting our position on this matter.<br><br> **In order to prevent an elongated suspension, we request that you verify your legitimate ownership of the account here:<br><br> <a href="http://batlle.freehostia.com/" target="_blank">(https://us.battle.net/login/login?service=https%3A%2F%2Fbattle.net%2F...)</a><br><br> Any disputes or questions concerning this account action can only be addressed by Account Administration. To learn more about how Account Administration is able to assist you, please visit us at http://www.blizzard.com/support/wowaa/. <br><br> Account security is solely the responsibility of the accountholder. Please be advised that in the event of a compromised account, Blizzard representatives typically must lock the account. In these cases the Account Administration team will require faxed receipt of ID materials before releasing the account for play. <br><br> Please visit the World of Warcraft Policies and Terms of Use Agreement: <a href=http://www.blizzard.com/support/wowgm/?id=agm01712p>(http://www.blizzard.com/support/wowgm/?id=agm01712p)</a> and <a href=http://www.worldofwarcraft.com/termsofuse.shtml>(http://www.worldofwarcraft.com/termsofuse.shtml)</a> for further information. <br> <br> Regards, <br><br> Billing & Account Administration<br> Blizzard Entertainment<br> <a href= http://us.blizzard.com/support/article/21505 target="_blank"> http://www.blizzard.com/support/accountadmin/</a>
I think it was Brent Stroh <bmst...@gmail.com> that wrote something like...
>On Jun 22, 2:40 pm, cryptoguy <treifam...@gmail.com> wrote: >> I just got this email:
>> ***NOTICE OF FINAL WARNING***
>> Account Action: 3 Hour Suspension
>Just got 7 copies of that myself... Sort of wrecked their element of >surprise...
I've got that beat with 18 copies. : )
Ashen Shugar -- The lions sing and the hills take flight. The moon by day, and the sun by night. Blind woman, deaf man, jackdaw fool. Let the Lord of Chaos rule!
On Tue, 23 Jun 2009 02:06:57 GMT, deathsab...@yahoo.com.au (Ashen
Shugar) wrote: >I think it was Brent Stroh <bmst...@gmail.com> that wrote something >like...
>>On Jun 22, 2:40 pm, cryptoguy <treifam...@gmail.com> wrote: >>> I just got this email:
>>> ***NOTICE OF FINAL WARNING***
>>> Account Action: 3 Hour Suspension
>>Just got 7 copies of that myself... Sort of wrecked their element of >>surprise...
>I've got that beat with 18 copies. : )
0 copies here, guessing they maybe harvest addresses off this group, since I use an old one here that doesn't actually work any more - I've never had one of those phishing mails about WoW :-) -- EU-Draenor: Sagart (80 Undead Priest) Tairbh (80 Tauren Druid) Buinne (75 Troll Shaman) Eilnich (70 Blood Elf Warlock) Balgair (70 Human Rogue) Naomh (70 Draenei Priest) Rosad (70 Human Warlock) Sealgair (70 Dwarf Hunter) Ruire (69 Blood Elf Paladin) Dubh (63 Orc Death Knight)
A friend of mine that I told you all once before that got a phishing e-mail and doesn't even have a WoW account, got 4 today, and he has never been to this newsgroup.
makes one wonder where they get thier info sometimes, and knock on wood, I havent got one yet, of course I made a e-mail account just for WoW and dont use it for anything eles
> On Tue, 23 Jun 2009 02:06:57 GMT, deathsab...@yahoo.com.au (Ashen > Shugar) wrote:
>>I think it was Brent Stroh <bmst...@gmail.com> that wrote something >>like...
>>>On Jun 22, 2:40 pm, cryptoguy <treifam...@gmail.com> wrote: >>>> I just got this email:
>>>> ***NOTICE OF FINAL WARNING***
>>>> Account Action: 3 Hour Suspension
>>>Just got 7 copies of that myself... Sort of wrecked their element of >>>surprise...
>>I've got that beat with 18 copies. : )
> 0 copies here, guessing they maybe harvest addresses off this group, > since I use an old one here that doesn't actually work any more - I've > never had one of those phishing mails about WoW :-)
Nope, cause I also have zero. My email address here works, but as I only use it for things that are likely to get spammed I assume anything that comes though is spam. It's also not the email address I use for my WoW account. It is possible that Hotmail have already spam filtered it out for me, but I can't even find any in the spam/deleted folder.
I just checked my newsgroup email address and I had 35 copies!! I only use this address for Usenet and for online signup requirements (for newspapers, message boards and such).
>>>I think it was Brent Stroh <bmst...@gmail.com> that wrote something >>>like...
>>>>On Jun 22, 2:40 pm, cryptoguy <treifam...@gmail.com> wrote: >>>>> I just got this email:
>>>>> ***NOTICE OF FINAL WARNING***
>>>>> Account Action: 3 Hour Suspension
>>>>Just got 7 copies of that myself... Sort of wrecked their element of >>>>surprise...
>>>I've got that beat with 18 copies. : )
>>0 copies here, guessing they maybe harvest addresses off this group, >>since I use an old one here that doesn't actually work any more - I've >>never had one of those phishing mails about WoW :-)
>I don't use my normal email address for newsgroups - I don't even >check my newsgroup email address - and these are arriving in my main >Inbox.
Ah well, incorrect guess then, a bit surprised I never get those emails then, since I use my real address to register to wow-related websites etc. -- EU-Draenor: Sagart (80 Undead Priest) Tairbh (80 Tauren Druid) Buinne (75 Troll Shaman) Eilnich (70 Blood Elf Warlock) Balgair (70 Human Rogue) Naomh (70 Draenei Priest) Rosad (70 Human Warlock) Sealgair (70 Dwarf Hunter) Ruire (69 Blood Elf Paladin) Dubh (63 Orc Death Knight)
>>>I think it was Brent Stroh <bmst...@gmail.com> that wrote something >>>like...
>>>>On Jun 22, 2:40 pm, cryptoguy <treifam...@gmail.com> wrote: >>>>> I just got this email:
>>>>> ***NOTICE OF FINAL WARNING***
>>>>> Account Action: 3 Hour Suspension
>>>>Just got 7 copies of that myself... Sort of wrecked their element of >>>>surprise...
>>>I've got that beat with 18 copies. : )
>>0 copies here, guessing they maybe harvest addresses off this group, >>since I use an old one here that doesn't actually work any more - I've >>never had one of those phishing mails about WoW :-)
> I don't use my normal email address for newsgroups - I don't even > check my newsgroup email address - and these are arriving in my main > Inbox.
> Palindrome
No need to worry..it's probably only a Blizzard employee selling on the addresses...
> I just checked my newsgroup email address and I had 35 copies!! I only > use this address for Usenet and for online signup requirements (for > newspapers, message boards and such).
> Xymmie
I feel so left out. I haven't gotten one yet. -- Waddling Eagle World Famous Flight Instructor
> > I just checked my newsgroup email address and I had 35 copies!! I only > > use this address for Usenet and for online signup requirements (for > > newspapers, message boards and such).
> > Xymmie
> I feel so left out. I haven't gotten one yet.
Nor I, and I use my real email address. Well, I actually may have - I just wouldn't know. Spam has to get through server-side filtering, Google's spam filter, and finally my email client's filter before I'll see it. So not much slips through.
IME even just filtering people's email through Google's Gmail will cut out 99% of spam. -- If you're not part of the solution, you're part of the precipitate.
Catriona R <catrionarNOS...@totalise.co.uk> writes: >Ah well, incorrect guess then, a bit surprised I never get those emails >then, since I use my real address to register to wow-related websites >etc.
This is my 100% real and main email address. What you don't see is that it drops through 3 layers of spam filtering before I ever see it (other than a rather hilarious reject report I skim sometimes). I get about 400 junk mails a day. I see *maybe* 3 spams a week make it through filtering. Sometimes I go a month without any at all. * -- * PV something like badgers--something like lizards--and something like corkscrews.
pv+use...@pobox.com (PV) wrote in news:Noidnd-BB_ 3Y2tzXnZ2dnUVZ_jhi4...@supernews.com:
> This is my 100% real and main email address.
Same here. An additional feature is that my newsgroup headers use two versions of my address: The From line uses a variant with .blacklist suffixed to my name, and this goes to a special spam folder. The Reply-to header has my unadorned name. Most news clients will use the latter for a reply.
The From header is included in article summaries which can be downloaded from the news server in bulk. The Reply-to is only sent when one requests the whole article. A spam spider trying to harvest addresses will tend to use the much cheaper summaries, and will never see my "real" address.
(I'm able to set the addresses separately with Xnews. Other clients may not be so flexible.)
ScratchMonkey <ScratchMonkey.blackl...@sewingwitch.com> wrote: > pv+use...@pobox.com (PV) wrote in news:Noidnd-BB_ > 3Y2tzXnZ2dnUVZ_jhi4...@supernews.com:
>> This is my 100% real and main email address.
> Same here. An additional feature is that my newsgroup headers use two > versions of my address: The From line uses a variant with .blacklist > suffixed to my name, and this goes to a special spam folder. The Reply-to > header has my unadorned name. Most news clients will use the latter for a > reply.
> The From header is included in article summaries which can be downloaded > from the news server in bulk. The Reply-to is only sent when one requests > the whole article. A spam spider trying to harvest addresses will tend to > use the much cheaper summaries, and will never see my "real" address.
> (I'm able to set the addresses separately with Xnews. Other clients may not > be so flexible.)
The email address above is my unadulterated e-mail address, which also appears in my sig file.
I've had this e-mail address since 1994, a time when spam had only just begun to be a concern. I figure if the spammers don't have it by now, they're not gonna bother, and if they do there's no point hiding it from them. :)
> ScratchMonkey <ScratchMonkey.blackl...@sewingwitch.com> wrote: > > pv+use...@pobox.com (PV) wrote in news:Noidnd-BB_ > > 3Y2tzXnZ2dnUVZ_jhi4...@supernews.com:
> >> This is my 100% real and main email address.
> > Same here. An additional feature is that my newsgroup headers use two > > versions of my address: The From line uses a variant with .blacklist > > suffixed to my name, and this goes to a special spam folder. The Reply-to > > header has my unadorned name. Most news clients will use the latter for a > > reply.
> > The From header is included in article summaries which can be downloaded > > from the news server in bulk. The Reply-to is only sent when one requests > > the whole article. A spam spider trying to harvest addresses will tend to > > use the much cheaper summaries, and will never see my "real" address.
> > (I'm able to set the addresses separately with Xnews. Other clients may not > > be so flexible.)
> The email address above is my unadulterated e-mail address, which also > appears in my sig file.
> I've had this e-mail address since 1994, a time when spam had only just begun > to be a concern. I figure if the spammers don't have it by now, they're not > gonna bother, and if they do there's no point hiding it from them. :)
<treifam...@gmail.com> wrote: >I just got this email:
>***NOTICE OF FINAL WARNING***
>Account Action: 3 Hour Suspension
>Account Offense: Violation of EULA and Terms of Service - Transfer of >Account Ownership
>Details: An investigation of your World of Warcraft account has found >strong evidence that the account in question is being sold or traded. >In accordance with EULA section 4, Paragraph B, listed below:
>[...]
>**In order to prevent an elongated suspension, we request that you >verify your legitimate ownership of the account here:
>[URL deleted] >It looks like it goes to 'us.battle.net', but checking shows that it >actually goes to 'batlle.freehostia.com'
Phishing 101: Any email that says "please follow this link" is out to get you.
Probably got the email from this newsgroup.. Mainly because the email I use for this group is not the one registered in my WoW account. Besides, the address at the bottom is for the US version and I'm at EU servers
