Issue: Cataclysm Opt In publicised email addy

#0 - July 30, 2010, 10:09 p.m.
Blizzard Post
The email address I use for my battle.net account is not used for anything else and typically has no traffic. In fact the only recent emails (as in last 6 months) to that address were caused by me changing passwords

I opted in to the Cataclysm Beta around the time opt ins were first allowed. Today I got a very interesting email. Note the source IP address for this email....IP 60.182.231.216 is owned by 163DATA.C O M . C N Beijing. Coincidentally that IP is assigned to DSL so can not be tracked to a specific user.

I seriously hope I do not start getting spam at this address, since I've protected its' integrity and expected Blizzard to do the same.

Here it is the message in its text version showing the full IP trail. I have not downloaded it from the email server as of yet - I use mailwasher for previewing messages in text for, and for deleting the hundred plus spam my other addresses get per day:

X-Message-Delivery: Vj0xLjE7dXM9MDtsPTA7YT0wO0Q9MjtTQ0w9NA==
X-Message-Status: n:0
X-SID-PRA: Blizzard Entertainment <[email protected]>
X-AUTH-Result: NONE
X-Message-Info: 6sSXyD95QpVr++KdOdwIIwnbNTu4fEh9FqFe5uoF5VSi3PsrAYLkIslzRcRHL6NsX4yEAtUUla5KbzrK0Bzmz0uXrTMPWgvUdUq9LOyzMo4=
Received: from tomts24-srv.bellnexxia.net ([209.226.175.187]) by BAY0-PAMC2-F5.Bay0.hotmail.com with Microsoft SMTPSVC(6.0.3790.4675);
Fri, 30 Jul 2010 07:34:46 -0700
Received: from toip31.srvr.bell.ca ([67.69.240.33])
by tomts24-srv.bellnexxia.net
(InterMail vM.5.01.06.13 201-253-122-130-113-20050324) with ESMTP
id <20100730143446.IGHF12145.tomts24-srv.bellnexxia.net@toip31.srvr.bell.ca>
for <[Removed]>; Fri, 30 Jul 2010 10:34:46 -0400
Received: from toip20.srvr.bell.ca ([67.69.240.22])
by toip31.srvr.bell.ca with ESMTP; 30 Jul 2010 10:34:43 -0400
Received: from blu0-omc3-s9.blu0.hotmail.com ([65.55.116.84])
by toip20.srvr.bell.ca with ESMTP; 30 Jul 2010 10:34:40 -0400
Received: from BLU0-SMTP101 ([65.55.116.72]) by blu0-omc3-s9.blu0.hotmail.com with Microsoft SMTPSVC(6.0.3790.4675);
Fri, 30 Jul 2010 07:34:39 -0700
X-Originating-IP: [60.182.231.216]
X-Originating-Email: [[email protected]]
Message-ID: <[email protected]>
Return-Path: [email protected]
Received: from lqmgntn ([60.182.231.216]) by BLU0-SMTP101.blu0.hotmail.com over TLS secured channel with Microsoft SMTPSVC(6.0.3790.4675);
Fri, 30 Jul 2010 07:34:36 -0700
From: "Blizzard Entertainment" <[email protected]>
To: <my logon address>
Subject: =?utf-8?B?QmxpenphcmQgRW50ZXJ0YWlubWU=?=
=?utf-8?B?bnQgQ2F0YWNseXNtIGJldGHigI8=?=
Date: Fri, 30 Jul 2010 22:12:57 +0800
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary="----=_NextPart_000_0A9E_01473425.1B5BFDC0"
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2900.5512
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.5512
X-OriginalArrivalTime: 30 Jul 2010 14:34:37.0090 (UTC) FILETIME=[55F5F820:01CB2FF4]

This is a multi-part message in MIME format.

------=_NextPart_000_0A9E_01473425.1B5BFDC0
Content-Type: text/plain;
charset="utf-8"
Content-Transfer-Encoding: base64

V29ybGQgb2YgV2FyY3JhZnQ6Q2F0YWNseXNtIEJldGEgVGVzdCBJbnZpdGF0aW9uIQ0KDQpHZXQg
dGhvc2Ugb3B0LWlucyByZWFkeSBmb3IgdGhlIFdvcmxkIG9mIFdhcmNyYWZ0OkNhdGFjbHlzbSBj
bG9zZWQgYmV0YSFUaGUgc3VuZGVyaW5nIG9mIEF6ZXJvdGggaXMgbmlnaCxhbmQgeW91IGRvbid0
IHdhbnQgdG8gYmUgbGVmdCBvdXQgaW4gdGhlIGNvbGQgb2YgTm9ydGhyZW5kIHdoZW4geW91IGNv
dWxkIGJlIGVuam95aW5nIHRoZSBzdW4tZHJlbmNoZWQgYmVhY2hlcyBvbiB0aGUgZ29ibGluIGlz
bGUgb2YgS2V6YW4uVG8gZW5zdXJlIHlvdSdyZSBvcHRlZC1pbiBhbmQgZWxpZ2libGUgYXMgYSBw
b3RlbnRpYWwgY2FuZGlkYXRlLHlvdSdsbCBuZWVkIGEgV29ybGQgb2YgV2FyY3JhZnQgbGljZW5z
ZSBhdHRhY2hlZCB0byB5b3VyIEJhdHRsZS5uZXQgYWNjb3VudCxoYXZlIHlvdXIgY3VycmVudCBz
eXN0ZW0gc3BlY2lmaWNhdGlvbnMgdXBsb2FkZWQgdG8gdGhlIEJhdHRsZS5uZXQgQmV0YSBQcm9m
aWxlIFNldHRpbmdzIHBhZ2UsYW5kIGhhdmUgZXhwcmVzc2VkIGludGVyZXN0IHRocm91Z2ggdGhl
IGZyYW5jaGlzZS1zcGVjaWZpYyBjaGVjayBib3hlcy4NCg0KR2V0IHRoZSBJbnN0YWxsZXIgLSBM
b2cgaW4gdG8geW91ciBCYXR0bGUubmV0IGFjY291bnQ6DQpodHRwczovL3VzLmJhdHRsZS5uZXQv
bG9naW4vZW4vbG9naW4uaHRtbD9yZWY9aHR0cHMlM0ElMkYlMkZ1cy5iYXR0bGUubmV0JTJGYWNj
b3VudCUyRm1hbmFnZW1lbnQlMkZiZXRhLXByb2ZpbGUueG1sJmFwcD1iYW0NCg0KRW5qb3kgdGhl
IGdhbWUhDQoNCkJsaXp6YXJkIEVudGVydGFpbm1lbnQsSW5jLg==

------=_NextPart_000_0A9E_01473425.1B5BFDC0
Content-Type: text/html;
charset="utf-8"
Content-Transfer-Encoding: base64

PCFET0NUWVBFIEhUTUwgUFVCTElDICItLy9XM0MvL0RURCBIVE1MIDQuMCBUcmFuc2l0aW9uYWwv
L0VOIj4NCjxIVE1MPjxIRUFEPg0KPE1FVEEgaHR0cC1lcXVpdj1Db250ZW50LVR5cGUgY29udGVu
dD0idGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij4NCjxNRVRBIGNvbnRlbnQ9Ik1TSFRNTCA2LjAw
LjI5MDAuNTg5NyIgbmFtZT1HRU5FUkFUT1I+PC9IRUFEPg0KPEJPRFk+PCEtLVN0YXJ0RnJhZ21l
bnQgLS0+DQo8RElWPjwhLS1TdGFydEZyYWdtZW50IC0tPg0KPERJVj48IS0tU3RhcnRGcmFnbWVu
dCAtLT4NCjxESVY+V29ybGQgb2YgV2FyY3JhZnQ6Q2F0YWNseXNtIEJldGEgVGVzdCBJbnZpdGF0
aW9uITwvRElWPg0KPERJVj4mbmJzcDs8L0RJVj4NCjxESVY+R2V0IHRob3NlIG9wdC1pbnMgcmVh
ZHkgZm9yIHRoZSBXb3JsZCBvZiBXYXJjcmFmdDpDYXRhY2x5c20gY2xvc2VkIGJldGEhVGhlIA0K
c3VuZGVyaW5nIG9mIEF6ZXJvdGggaXMgbmlnaCxhbmQgeW91IGRvbid0IHdhbnQgdG8gYmUgbGVm
dCBvdXQgaW4gdGhlIGNvbGQgb2YgDQpOb3J0aHJlbmQgd2hlbiB5b3UgY291bGQgYmUgZW5qb3lp
bmcgdGhlIHN1bi1kcmVuY2hlZCBiZWFjaGVzIG9uIHRoZSBnb2JsaW4gaXNsZSANCm9mIEtlemFu
LlRvIGVuc3VyZSB5b3UncmUgb3B0ZWQtaW4gYW5kIGVsaWdpYmxlIGFzIGEgcG90ZW50aWFsIGNh
bmRpZGF0ZSx5b3UnbGwgDQpuZWVkIGEgV29ybGQgb2YgV2FyY3JhZnQgbGljZW5zZSBhdHRhY2hl
ZCB0byB5b3VyIEJhdHRsZS5uZXQgYWNjb3VudCxoYXZlIHlvdXIgDQpjdXJyZW50IHN5c3RlbSBz
cGVjaWZpY2F0aW9ucyB1cGxvYWRlZCB0byB0aGUgQmF0dGxlLm5ldCBCZXRhIFByb2ZpbGUgU2V0
dGluZ3MgDQpwYWdlLGFuZCBoYXZlIGV4cHJlc3NlZCBpbnRlcmVzdCB0aHJvdWdoIHRoZSBmcmFu
Y2hpc2Utc3BlY2lmaWMgY2hlY2sgDQpib3hlcy48L0RJVj4NCjxESVY+Jm5ic3A7PC9ESVY+DQo8
RElWPkdldCB0aGUgSW5zdGFsbGVyIC0gTG9nIGluIHRvIHlvdXIgQmF0dGxlLm5ldCBhY2NvdW50
OjwvRElWPg0KPERJVj48QSBocmVmPSJodHRwOi8vd3d3Lndvcmxkb2Z3YXJjcmFmdC1jYXRhY2x5
c20tYmV0YS5uZXQ6MSI+PEZPTlQgDQpjb2xvcj1ibHVlPmh0dHBzOi8vdXMuYmF0dGxlLm5ldC9s
b2dpbi9lbi9sb2dpbi5odG1sP3JlZj1odHRwcyUzQSUyRiUyRnVzLmJhdHRsZS5uZXQlMkZhY2Nv
dW50JTJGbWFuYWdlbWVudCUyRmJldGEtcHJvZmlsZS54bWwmYW1wO2FwcD1iYW08L0ZPTlQ+PC9Bjavascript:bmlWrapper('pre');
PjwvRElWPg0KPERJVj4mbmJzcDs8L0RJVj4NCjxESVY+RW5qb3kgdGhlIGdhbWUhPC9ESVY+DQo8
RElWPiZuYnNwOzwvRElWPg0KPERJVj5CbGl6emFyZCBFbnRlcnRhaW5tZW50LEluYy48L0RJVj48
L0RJVj48L0RJVj48L0JPRFk+PC9IVE1MPg0K

------=_NextPart_000_0A9E_01473425.1B5BFDC0--


Edit: Missed that some characters in the 123DATA.C O M . C N (remove spaces for correct name) were turned into an interesting series of @%#$@^...which I ironically agree probably describes them. Fixed that however.
#5 - July 31, 2010, 12:10 a.m.
Blizzard Post
Q u o t e:
Ah, yes, I did miss the address in one spot. TY, for catching that Vraktrhis.


Welcome, I just didn't want you getting hit with more spam. :)

A lot of phishing attempts are sent to random addresses, so it is possible that what you received was a true phishing attempt, casting the line in a random direction hoping to get a bite. After all it doesn't cost anything to send an e-mail.

Beyond that though, I'm not certain what to tell you. We do not provide e-mail addresses to third parties.