Take the 2-minute tour ×
Arqade is a question and answer site for passionate videogamers on all platforms. It's 100% free, no registration required.

I just got an email:

Dear Players,

Take a trip back to Azeroth with 7 days of FREE game time! Simply click below to claim your time and experience all of the latest improvements and additions to World of Warcraft®... but act fast, as this offer will expire on Mar 22, 2011.

It looks incredibly professional, and looks very real. The only suspicious thing is the link to claim 7 free days of game time, which seems to be a squat of battle.net (you can see the actual link in the revision history for this post if you're so inclined).

How can I tell if this an actual Blizzard thing, or if I'm being phished?

share|improve this question
1  
There's no need to mention the offending domain name (and lead people towards it); the domain is actually already "hidden" in the page so Google can find it if reqd. –  badp Mar 15 '11 at 0:25
2  
I get that email although I have never played WoW and my battle.net account is registered on a completely different email address. –  poke Mar 15 '11 at 7:55
    
Odd, I have the same recent mail, and all the links in it point to legit sites... what am I missing ? –  jokoon Mar 15 '11 at 12:10
1  
@gokoon The link LOOKS like it points to a legit site (i.e. the text of the link looks like that) but it actually takes you somewhere else. Mouse over the link and see what the destination really is. –  DJClayworth Mar 15 '11 at 15:43
2  
If you're ever unsure, you can always skip the link and then go to battle net manually. Any official offer will also probably be shown when you log in to the real site. –  Jeroen Mar 24 '12 at 9:02
show 1 more comment

9 Answers 9

The whois record for that domain was just registered on the 11th of March. And not by Blizzard but by someone at a nondescript chinese address.

I would stay away, sounds like phishing.

share|improve this answer
4  
+1 For checking the record. Easiest way to find out. –  Sadly Not Mar 15 '11 at 16:50
add comment

This is a scam that is a variation of a real email that Blizzard sent out on November 10th, 2010. The difference is that the link in that email went to www.worldofwarcraft.com, which is a real Blizzard site.

To be exact, the link was: https://www.worldofwarcraft.com/account/claim-promotion.html?promoId=SEVEN_DAYS_PROMOTION

However, this offer ended December 1st 2010, the week before Cataclysm was released.

Other clues from Blizzard that the real version was legitimate was the use of the user's first name at the top of the email.

share|improve this answer
    
Note: This promotion is occasionally repeated with the same URL. –  user2974 Nov 30 '11 at 7:07
    
Usually these emails get made with links to the real site (ie. WoWs site, Blizzards etc.) but then the link you have to click on to login is some strange domain, that looks like the original, but isn't: eg. us.battle.net.tk (note the TK at the end) –  Holger Mar 24 '12 at 9:29
add comment

Sounds like hackers. Best thing to do is log in to your account (to Blizzard's official site, not any links from the email) and check if there are any offers there.

share|improve this answer
add comment

While you're right that this is hackers ( I'm glad that URL sends out warning bells), there is a single precedent for this. Blizzard has done this once, for WoW's 6th anniversary (...or maybe fifth?) to all inactive accounts. (I'm betting your WoW account isn't inactive, though.)

It looks like the text of that previous announcement email was stolen for the phisher's own use, and so it is very likely the whole scenario is a sham.

share|improve this answer
1  
I am not satisfied with this answer. Not quite sure why. I can't even claim drunkenness like Tzenes... –  Raven Dreamer Mar 15 '11 at 0:24
    
You can claim anything. –  user56 Mar 15 '11 at 15:44
    
Definitely "stolen" text from the original email, because we all know that a Chinese h4x0r couldn't write a single, grammatically correct sentence in English if their life depended on it. –  Jagd Mar 15 '11 at 21:29
add comment

While your mail you got really seems to be a scam, note that apparently there actually is an active promotion for the european servers.

On 11.03.2011 I got such a promotion email, which correctly included my first name and also correctly links to www dot wow-europe dot com slash account slash claim-promotion.html?promoId=SEVEN_DAYS_PROMOTION. (plus: It's in proper german, and that would have been the first scam I see that uses really proper german ;-)

Hope this helps.

share|improve this answer
add comment

I used to play on a Spanish European server and I got a legit "come back" for seven days.

It points to

http://www.wow-europe.com/account/claim-promotion.html?promoId=SEVEN_DAYS_PROMOTION

My char was level 60 when I stopped playing WoW. ;)

share|improve this answer
add comment

One way to attempt to determine if a site is fake is to input incorrect information and see if it can tell the difference.

If it pretends it worked, you can be pretty sure it's a phishing site.

If it fails, you can't be sure. I would guess most phishing sites aren't that sophisticated, but in theory, they could take your provided info, try it on the real site, determine if it worked, and present that info to you automatically.

share|improve this answer
    
This is what I often do. You might not know it, but more phishing sites accept ANYTHING and 'logs you in'. –  DMan Mar 16 '11 at 0:33
    
jfy, If I would implement a phishing site I would use the information entered towards the blizzard site. So if you enter incorrect information that phising site will tell you. –  RamonBoza Jan 28 at 14:48
add comment

Whenever you get an email that you're suspicious of, you can open up the full message header. This is a record of how the message got to you. In Outlook 2010, go to File -> Properties -> Internet Header. Look at the servers the message passed through before arriving in your inbox. Do they have strange names and/or .ru or .cn domains? Then they're probably fake. See http://email.about.com/cs/spamgeneral/a/spam_headers.htm for more information.

share|improve this answer
add comment

Many answers have pointed out that this is a scam. I'll go one further.

"Never, ever, click on a link you find in an unsolicited email".

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.