Another phishing email to add to the list

#0 - June 30, 2010, 9:01 p.m.
Blizzard Post
Just got this one today. The greeting was amusing. This was sent to an account that is NOT my battle.net email.

Greetings <removed>,

This is an automated notification sent from our account support system. We have received your petition about the account ownership via email: <email removed, was the one they sent it to>. Your petition has been forwarded to our Account Specialists for further investigation and troubleshooting. Please keep in mind that, due to the nature and complexity of these types of petitions, it may take several days for us to contact you with the results of your investigation. You should use our account management website to review your petition and account status: http://us.battle.net.

The following information will greatly assist in expediting your petition; if any of the below is not currently included you may edit your ticket(use the link above):

- What are you requesting for restoration/refund/exchange
- Name of Character and Realm affected
- Approximate Time of loss or issue

If these details are currently missing from your petition, please add them in by right clicking on the open petition icon and selecting Edit whick you can find in the account management website. Please be advised we will be unable to respond via in-game e-mail.

*** If you did NOT send this petition to us, we recommend you login to Account Management at the following link to check your account settings and security status as soon as possible:
http://www.worldofwarcraft.com/account/security/

Regards,
Erzmael
Game Master
Blizzard Entertainment
www.worldofwarcraft.com

-- end cut/past

There's a typo in there ("selecting Edit whick") but overall looks almost authentic.

I actually was curious because I had just sent Blizzard a mail from this email address and while I wasnt expecting a reply, an automated response wouldn't have been out of the ordinary. The account management link they used was spoofed. It is included here for viewing(check post edits if you need it, mods).

<edited url out>

I can provide the full email headers if you'd like as well.
#3 - June 30, 2010, 9:17 p.m.
Blizzard Post
Q u o t e:
Just got this one today. The greeting was amusing. This was sent to an account that is NOT my battle.net email.

Greetings <removed>,

This is an automated notification sent from our account support system. We have received your petition about the account ownership via email: <email removed, was the one they sent it to>. Your petition has been forwarded to our Account Specialists for further investigation and troubleshooting. Please keep in mind that, due to the nature and complexity of these types of petitions, it may take several days for us to contact you with the results of your investigation. You should use our account management website to review your petition and account status: http://us.battle.net.

The following information will greatly assist in expediting your petition; if any of the below is not currently included you may edit your ticket(use the link above):

- What are you requesting for restoration/refund/exchange
- Name of Character and Realm affected
- Approximate Time of loss or issue

If these details are currently missing from your petition, please add them in by right clicking on the open petition icon and selecting Edit whick you can find in the account management website. Please be advised we will be unable to respond via in-game e-mail.

*** If you did NOT send this petition to us, we recommend you login to Account Management at the following link to check your account settings and security status as soon as possible:
http://www.worldofwarcraft.com/account/security/

Regards,
Erzmael
Game Master
Blizzard Entertainment
www.worldofwarcraft.com

-- end cut/past

There's a typo in there ("selecting Edit whick") but overall looks almost authentic.

I actually was curious because I had just sent Blizzard a mail from this email address and while I wasnt expecting a reply, an automated response wouldn't have been out of the ordinary. The account management link they used was spoofed. It is included here for viewing(check post edits if you need it, mods).

<edited url out>

I can provide the full email headers if you'd like as well.


Great catch, Arcata! Added:

http://forums.worldofwarcraft.com/thread.html?topicId=965511383&postId=256239902302&sid=1#110