GM look at this

#0 - Nov. 10, 2010, 12:22 a.m.
Blizzard Post
This message look very real, and I looked up the IP and found it in a place in PA, I'll delete my name off the email but want a GM's opnion please.



From Blizzard Entertainment Mon Nov 8 14:37:07 2010
X-Apparently-To: CENSORED@sbcglobal.net via 68.142.199.105; Mon, 08 Nov 2010 14:38:52 -0800
Return-Path: <noreply@blizzard.com>
X-YahooFilteredBulk: 64.191.100.246
Received-SPF: fail (mta1032.sbc.mail.mud.yahoo.com: domain of noreply@blizzard.com does not designate 64.191.100.246 as permitted sender)
X-YMailISG: l0CBHOEcZAq9AtxJPkeiv49ZSf32Z_6jjsbrpRO8pSC39EB0 6UM6yTlX73b_6DXufIFRyoxtYjLR9acxQ1DdfhOW.zYxUryTDuUXhw6EEE0U UYfmR_BZuhTeDpOAKrp7W6O.oM8qA4YZZlzmlWft7s8.oBcghi8EIx0UWiRP BGwUjM.QZXpQHHVX2n6opTbu_Bqlu5co0gSO7wUHkupTotbMab.1nIIHKTiN 09LmK8ky5Qrb3qUPE8YYd_50fRBR3yWb_h_y3eti3gdzA4.NcdmPxrkLCEGv GNs6LtSM4cV.3fqnKpenJNz7UuypI3r7oOWz4TtzUGaW8Ics6r.9PRBLlY1K jBlt739ufW42WVHeuoq58YnXYgsUcx3N3zPSmHx8QbBMmCQ-
X-Originating-IP: [64.191.100.246]
Authentication-Results: mta1032.sbc.mail.mud.yahoo.com from=blizzard.com; domainkeys=neutral (no sig); from=blizzard.com; dkim=neutral (no sig)
Received: from 207.115.20.16 (EHLO flph257.prodigy.net) (207.115.20.16) by mta1032.sbc.mail.mud.yahoo.com with SMTP; Mon, 08 Nov 2010 14:38:52 -0800
X-Originating-IP: [64.191.100.246]
Received: from blizzard.com (64-191-100-246.hostnoc.net [64.191.100.246] (may be forged)) by flph257.prodigy.net (8.14.4 IN/8.14.4) with ESMTP id oA8MclpL014251 for <CENSORED@sbcglobal.net>; Mon, 8 Nov 2010 14:38:50 -0800
Message-Id: <201011082238.oA8MclpL014251@flph257.prodigy.net>
From: "Blizzard Entertainment" <noreply@blizzard.com> Add sender to Contacts
Subject: An Account Recovery Form has been submitted for
To: CENSORED@sbcglobal.net
Content-Type: text/plain;charset="GB2312"
Content-Transfer-Encoding: 8bit
Date: Tue, 9 Nov 2010 06:37:07 +0800
X-Priority: 3
X-Mailer: FoxMail 4.0 beta 2 [cn]
Content-Length: 1895


What does this mean?

We received a report that this account has been compromised, and we are taking the appropriate steps to help restore your access to this account as quickly as possible.


What steps did we take?

The password for this Battle.net account has been reset. Please check your email account for a message regarding your new temporary password.

You can confirm that you are the original owner of the account nformation to this secure website with: Removed
In addition, we opened a Battle.net service ticket to restore your World of Warcraft character(s) and item(s). Your ticket number is 8518623. We'll send you another email when the process is complete, which under normal conditions usually takes 10 to 12 working hours (but please allow up to 2 working days). You do not need to open an in-game service ticket.


Why can’t I log into the game?

In some cases, including when the account was used in ways that violated our Terms of Use, you may not be able to log into some login-protected services (such as World of Warcraft) until all restrictions on the account have been removed.


What do I need to do now?

After you change your password, if you notice any unauthorized transactions on this account, please give us the time to address them from the service ticket prior to filing a duplicate request in-game. In addition, you can find some suggestions on improving your computer's security on our account security website, Removed
After that, we hope you can rest a little easier. You've just helped us get you back into World of Warcraft and this Battle.net account as soon as possible.

If you have any additional questions or concerns, our contact information can be found here: http://us.blizzard.com/support/cs.


Thank you,

The Customer Support Team




This message looked way too good to be true and i have NOT submitted a account recovery or anything.

Thanks Troop
#3 - Nov. 10, 2010, 12:30 a.m.
Blizzard Post
Kassian's observations are spot on, Trooper. Very much a fake. This is definitely a convincing e-mail, and we'd appreciate it if you could forward it, along with the headers you posted, to hacks@blizzard.com for investigation.

In addition, should you want some tips on how to read headers or otherwise identify such phishy attempts, you'll want to check out our related support article.

How to Identify Fake or Phishing Emails
http://us.blizzard.com/support/article/25133