21

I just got an email:

Dear Players,

Take a trip back to Azeroth with 7 days of FREE game time! Simply click below to claim your time and experience all of the latest improvements and additions to World of Warcraft®... but act fast, as this offer will expire on Mar 22, 2011.

It looks incredibly professional, and looks very real. The only suspicious thing is the link to claim 7 free days of game time, which seems to be a squat of battle.net (you can see the actual link in the revision history for this post if you're so inclined).

How can I tell if this an actual Blizzard thing, or if I'm being phished?

Improve this question
6
  • 1
    There's no need to mention the offending domain name (and lead people towards it); the domain is actually already "hidden" in the page so Google can find it if reqd.
    – badp
    Mar 15, 2011 at 0:25
  • 2
    I get that email although I have never played WoW and my battle.net account is registered on a completely different email address.
    – poke
    Mar 15, 2011 at 7:55
  • Odd, I have the same recent mail, and all the links in it point to legit sites... what am I missing ?
    – jokoon
    Mar 15, 2011 at 12:10
  • 1
    @gokoon The link LOOKS like it points to a legit site (i.e. the text of the link looks like that) but it actually takes you somewhere else. Mouse over the link and see what the destination really is.
    – DJClayworth
    Mar 15, 2011 at 15:43
  • 2
    If you're ever unsure, you can always skip the link and then go to battle net manually. Any official offer will also probably be shown when you log in to the real site.
    – Jeroen
    Mar 24, 2012 at 9:02

9 Answers 9

Reset to default
34

The whois record for that domain was just registered on the 11th of March. And not by Blizzard but by someone at a nondescript chinese address.

I would stay away, sounds like phishing.

Improve this answer
0
34

This is a scam that is a variation of a real email that Blizzard sent out on November 10th, 2010. The difference is that the link in that email went to www.worldofwarcraft.com, which is a real Blizzard site.

To be exact, the link was: https://www.worldofwarcraft.com/account/claim-promotion.html?promoId=SEVEN_DAYS_PROMOTION

However, this offer ended December 1st 2010, the week before Cataclysm was released.

Other clues from Blizzard that the real version was legitimate was the use of the user's first name at the top of the email.

Improve this answer
2
  • Note: This promotion is occasionally repeated with the same URL.
    – user2974
    Nov 30, 2011 at 7:07
  • Usually these emails get made with links to the real site (ie. WoWs site, Blizzards etc.) but then the link you have to click on to login is some strange domain, that looks like the original, but isn't: eg. us.battle.net.tk (note the TK at the end)
    – Holger
    Mar 24, 2012 at 9:29
5

Sounds like hackers. Best thing to do is log in to your account (to Blizzard's official site, not any links from the email) and check if there are any offers there.

Improve this answer
2

While you're right that this is hackers ( I'm glad that URL sends out warning bells), there is a single precedent for this. Blizzard has done this once, for WoW's 6th anniversary (...or maybe fifth?) to all inactive accounts. (I'm betting your WoW account isn't inactive, though.)

It looks like the text of that previous announcement email was stolen for the phisher's own use, and so it is very likely the whole scenario is a sham.

Improve this answer
3
  • 1
    I am not satisfied with this answer. Not quite sure why. I can't even claim drunkenness like Tzenes...
    – Raven Dreamer
    Mar 15, 2011 at 0:24
  • You can claim anything.
    – user56
    Mar 15, 2011 at 15:44
  • Definitely "stolen" text from the original email, because we all know that a Chinese h4x0r couldn't write a single, grammatically correct sentence in English if their life depended on it.
    – Jagd
    Mar 15, 2011 at 21:29
1

While your mail you got really seems to be a scam, note that apparently there actually is an active promotion for the european servers.

On 11.03.2011 I got such a promotion email, which correctly included my first name and also correctly links to www dot wow-europe dot com slash account slash claim-promotion.html?promoId=SEVEN_DAYS_PROMOTION. (plus: It's in proper german, and that would have been the first scam I see that uses really proper german ;-)

Hope this helps.

Improve this answer
1

I used to play on a Spanish European server and I got a legit "come back" for seven days.

It points to

http://www.wow-europe.com/account/claim-promotion.html?promoId=SEVEN_DAYS_PROMOTION

My char was level 60 when I stopped playing WoW. ;)

Improve this answer
1

One way to attempt to determine if a site is fake is to input incorrect information and see if it can tell the difference.

If it pretends it worked, you can be pretty sure it's a phishing site.

If it fails, you can't be sure. I would guess most phishing sites aren't that sophisticated, but in theory, they could take your provided info, try it on the real site, determine if it worked, and present that info to you automatically.

Improve this answer
2
  • This is what I often do. You might not know it, but more phishing sites accept ANYTHING and 'logs you in'.
    – DMan
    Mar 16, 2011 at 0:33
  • jfy, If I would implement a phishing site I would use the information entered towards the blizzard site. So if you enter incorrect information that phising site will tell you.
    – RamonBoza
    Jan 28, 2014 at 14:48
1

Whenever you get an email that you're suspicious of, you can open up the full message header. This is a record of how the message got to you. In Outlook 2010, go to File -> Properties -> Internet Header. Look at the servers the message passed through before arriving in your inbox. Do they have strange names and/or .ru or .cn domains? Then they're probably fake. See http://email.about.com/cs/spamgeneral/a/spam_headers.htm for more information.

Improve this answer
0

Many answers have pointed out that this is a scam. I'll go one further.

"Never, ever, click on a link you find in an unsolicited email".

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .