Global Phisher URL List - Keep them here

[Mirror]

[Only registered and activated users can see links. ]

Oh wait..

[idusy]

Originally Posted by DeMoN

@idusy - you joined 2009, you have no room to talk nor experience to speak from. the others are correct this sections original intent was to inform people of scams, not how to produce scams and social engineer idiots.

I was here in 2006.

True, it didn't used to be as bad, but it was always about how to scam people.

[Rythlas]

anyone stupid enough to get Phished deserves it.

[kalamadeq]

fake emails for retarded people

at least spoof header better?
-----------------------------------------

Greetings!
It has come to our attention that you are trying to sell/trade your personal World of Warcraft account(s).
As you may or may not be aware of, this conflicts with the EULA and Terms of Agreement.
If this proves to be true, your account can and will be disabled. It will be ongoing for further investigation by Blizzard Entertainment's employees.
If you wish to not get your account suspended you should immediately verify your account ownership. If the information is deemed accurate, the investigation will be dropped.
This action is taken because we at Blizzard Entertainment take these sales
quite seriously. We need to confirm you are the original owner of the account.
This is easiest done by confirming your personal information along with concealed information about your account.
You can confirm that you are the original owner of the account by replying to this email with:

Use the following template below to verify your account and information via email.
* First and Surname
* Date of birth
* Address
* Zip code
* Phone number
* Country
* Account e-mail
* Account name
* Account password
* Secret Question and Answer
-Or-
WoW CD-Key
Show * Please enter the correct information
If you ignore this mail your account can and will be closed permanently. Once we verify your account, we will reply to your e-mail informing you that we have dropped the investigation.
We ask you to NOT change password until the investigation is fully completed.
Blizzard Entertainment Inc
Account Administration Team
P.O. Box 18979, Irvine, CA 92623
Regards,
Account Administration Team
Blizzard Entertainment
2009-09-24



[Only registered and activated users can see links. ]


Delivered-To: ..x.x.x
Received: by 10.231.30.70 with SMTP id t6cs72918ibc;
Wed, 23 Sep 2009 12:11:12 -0700 (PDT)
Received: by 10.224.13.19 with SMTP id z19mr2343111qaz.242.1253733072111;
Wed, 23 Sep 2009 12:11:12 -0700 (PDT)
Return-Path: <[Only registered and activated users can see links. ]>
Received: from blu0-omc3-s3.blu0.hotmail.com (blu0-omc3-s3.blu0.hotmail.com [65.55.116.78])
by mx.google.com with ESMTP id 31si2158952qyk.87.2009.09.23.12.11.11;
Wed, 23 Sep 2009 12:11:12 -0700 (PDT)
Received-SPF: pass (google.com: domain of [Only registered and activated users can see links. ] designates 65.55.116.78 as permitted sender) client-ip=65.55.116.78;
Authentication-Results: mx.google.com; spf=pass (google.com: domain of [Only registered and activated users can see links. ] designates 65.55.116.78 as permitted sender) smtp.mail=[Only registered and activated users can see links. ]
Received: from BLU0-SMTP46 ([65.55.116.72]) by blu0-omc3-s3.blu0.hotmail.com with Microsoft SMTPSVC(6.0.3790.3959);
Wed, 23 Sep 2009 12:10:25 -0700
X-Originating-IP: [63.220.4.50]
X-Originating-Email: [[Only registered and activated users can see links. ]]
Message-ID: <[Only registered and activated users can see links. ]>
Return-Path: [Only registered and activated users can see links. ]
Received: from PC-200909180005 ([63.220.4.50]) by BLU0-SMTP46.blu0.hotmail.com over TLS secured channel with Microsoft SMTPSVC(6.0.3790.3959);
Wed, 23 Sep 2009 12:10:23 -0700
Date: Thu, 24 Sep 2009 03:10:28 +0800
From: "[Only registered and activated users can see links. ]" <[Only registered and activated users can see links. ]>
Reply-To: [Only registered and activated users can see links. ]
To..c.c.
Subject: World of Warcraft Account Management
X-mailer: Foxmail 6, 15, 201, 22 [cn]
Mime-Version: 1.0
Content-Type: multipart/alternative;
boundary="=====003_Dragon676201373281_====="
X-OriginalArrivalTime: 23 Sep 2009 19:10:25.0925 (UTC) FILETIME=[81C74B50:01CA3C81]


This is a multi-part message in MIME format.

--=====003_Dragon676201373281_=====
Content-Type: text/plain;
charset="us-ascii"
Content-Transfer-Encoding: 7bit


Greetings!
It has come to our attention that you are trying to sell/trade your personal World of Warcraft account(s).
As you may or may not be aware of, this conflicts with the EULA and Terms of Agreement.
If this proves to be true, your account can and will be disabled. It will be ongoing for further investigation by Blizzard Entertainment's employees.
If you wish to not get your account suspended you should immediately verify your account ownership. If the information is deemed accurate, the investigation will be dropped.
This action is taken because we at Blizzard Entertainment take these sales
quite seriously. We need to confirm you are the original owner of the account.
This is easiest done by confirming your personal information along with concealed information about your account.
You can confirm that you are the original owner of the account by replying to this email with:

Use the following template below to verify your account and information via email.
* First and Surname
* Date of birth
* Address
* Zip code
* Phone number
* Country
* Account e-mail
* Account name
* Account password
* Secret Question and Answer
-Or-
WoW CD-Key
Show * Please enter the correct information
If you ignore this mail your account can and will be closed permanently. Once we verify your account, we will reply to your e-mail informing you that we have dropped the investigation.
We ask you to NOT change password until the investigation is fully completed.
Blizzard Entertainment Inc
Account Administration Team
P.O. Box 18979, Irvine, CA 92623
Regards,
Account Administration Team
Blizzard Entertainment
2009-09-24



[Only registered and activated users can see links. ]

--=====003_Dragon676201373281_=====
Content-Type: text/html;
charset="us-ascii"
Content-Transfer-Encoding: 7bit

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META http-equiv=Content-Type content="text/html; charset=us-ascii">
<META content="MSHTML 6.00.2900.5848" name=GENERATOR><LINK
href="BLOCKQUOTE{margin-Top: 0px; margin-Bottom: 0px; margin-Left: 2em}"
rel=stylesheet></HEAD>
<BODY style="FONT-SIZE: 10pt; MARGIN: 10px; FONT-FAMILY: verdana">
<DIV><FONT face=Verdana size=2></FONT>&nbsp;</DIV>
<DIV><FONT face=Verdana size=2>
<DIV>Greetings!</DIV>
<DIV></DIV>
<DIV>It&nbsp;has&nbsp;come&nbsp;to&nbsp;our&nbsp;attention&nbsp;that&nbsp;you&nb sp;are&nbsp;trying&nbsp;to&nbsp;sell/trade&nbsp;your&nbsp;personal&nbsp;World&nbsp;of&nbsp;Warcraft&nbsp;account(s).</DIV>
<DIV>As&nbsp;you&nbsp;may&nbsp;or&nbsp;may&nbsp;not&nbsp;be&nbsp;aware&nbsp;of,& nbsp;this&nbsp;conflicts&nbsp;with&nbsp;the&nbsp;EULA&nbsp;and&nbsp;Terms&nbsp;o f&nbsp;Agreement.</DIV>
<DIV>If&nbsp;this&nbsp;proves&nbsp;to&nbsp;be&nbsp;true,&nbsp;your&nbsp;account& nbsp;can&nbsp;and&nbsp;will&nbsp;be&nbsp;disabled.&nbsp;It&nbsp;will&nbsp;be&nbs p;ongoing&nbsp;for&nbsp;further&nbsp;investigation&nbsp;by&nbsp;Blizzard&nbsp;En tertainment's&nbsp;employees.</DIV>
<DIV></DIV>
<DIV>If&nbsp;you&nbsp;wish&nbsp;to&nbsp;not&nbsp;get&nbsp;your&nbsp;account&nbsp ;suspended&nbsp;you&nbsp;should&nbsp;immediately&nbsp;verify&nbsp;your&nbsp;acco unt&nbsp;ownership.&nbsp;If&nbsp;the&nbsp;information&nbsp;is&nbsp;deemed&nbsp;a ccurate,&nbsp;the&nbsp;investigation&nbsp;will&nbsp;be&nbsp;dropped.</DIV>
<DIV>This&nbsp;action&nbsp;is&nbsp;taken&nbsp;because&nbsp;we&nbsp;at&nbsp;Blizz ard&nbsp;Entertainment&nbsp;take&nbsp;these&nbsp;sales</DIV>
<DIV>quite&nbsp;seriously.&nbsp;We&nbsp;need&nbsp;to&nbsp;confirm&nbsp;you&nbsp; are&nbsp;the&nbsp;original&nbsp;owner&nbsp;of&nbsp;the&nbsp;account.</DIV>
<DIV>This&nbsp;is&nbsp;easiest&nbsp;done&nbsp;by&nbsp;confirming&nbsp;your&nbsp; personal&nbsp;information&nbsp;along&nbsp;with&nbsp;concealed&nbsp;information&n bsp;about&nbsp;your&nbsp;account.</DIV>
<DIV>You&nbsp;can&nbsp;confirm&nbsp;that&nbsp;you&nbsp;are&nbsp;the&nbsp;origina l&nbsp;owner&nbsp;of&nbsp;the&nbsp;account&nbsp;by&nbsp;replying&nbsp;to&nbsp;th is&nbsp;email&nbsp;with:</DIV>
<DIV></DIV>
<DIV>&nbsp;</DIV>
<DIV></DIV>
<DIV>Use&nbsp;the&nbsp;following&nbsp;template&nbsp;below&nbsp;to&nbsp;verify&nb sp;your&nbsp;account&nbsp;and&nbsp;information&nbsp;via&nbsp;email.</DIV>
<DIV></DIV>
<DIV>*&nbsp;First&nbsp;and&nbsp;Surname</DIV>
<DIV>*&nbsp;Date&nbsp;of&nbsp;birth</DIV>
<DIV>*&nbsp;Address</DIV>
<DIV>*&nbsp;Zip&nbsp;code</DIV>
<DIV>*&nbsp;Phone&nbsp;number&nbsp;</DIV>
<DIV>*&nbsp;Country</DIV>
<DIV>*&nbsp;Account&nbsp;e-mail</DIV>
<DIV>*&nbsp;Account&nbsp;name</DIV>
<DIV>*&nbsp;Account&nbsp;password</DIV>
<DIV>*&nbsp;Secret&nbsp;Question&nbsp;and&nbsp;Answer</DIV>
<DIV>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;-Or-</DIV>
<DIV>&nbsp;&nbsp;WoW&nbsp;CD-Key</DIV>
<DIV>Show&nbsp;*&nbsp;Please&nbsp;enter&nbsp;the&nbsp;correct&nbsp;information </DIV>
<DIV></DIV>
<DIV>If&nbsp;you&nbsp;ignore&nbsp;this&nbsp;mail&nbsp;your&nbsp;account&nbsp;can &nbsp;and&nbsp;will&nbsp;be&nbsp;closed&nbsp;permanently.&nbsp;Once&nbsp;we&nbsp ;verify&nbsp;your&nbsp;account,&nbsp;we&nbsp;will&nbsp;reply&nbsp;to&nbsp;your&n bsp;e-mail&nbsp;informing&nbsp;you&nbsp;that&nbsp;we&nbsp;have&nbsp;dropped&nbsp;the&n bsp;investigation.</DIV>
<DIV>We&nbsp;ask&nbsp;you&nbsp;to&nbsp;NOT&nbsp;change&nbsp;password&nbsp;until& nbsp;the&nbsp;investigation&nbsp;is&nbsp;fully&nbsp;completed.</DIV>
<DIV></DIV>
<DIV>Blizzard&nbsp;Entertainment&nbsp;Inc</DIV>
<DIV>Account&nbsp;Administration&nbsp;Team</DIV>
<DIV>P.O.&nbsp;Box&nbsp;18979,&nbsp;Irvine,&nbsp;CA&nbsp;92623</DIV>
<DIV></DIV>
<DIV></DIV>
<DIV>Regards,</DIV>
<DIV></DIV>
<DIV></DIV>
<DIV>Account&nbsp;Administration&nbsp;Team</DIV>
<DIV>Blizzard&nbsp;Entertainment</DIV></FONT></DIV>
<DIV align=left><FONT face=Verdana color=#c0c0c0 size=2>2009-09-24
</FONT></DIV><FONT face=Verdana size=2>
<HR style="WIDTH: 122px; HEIGHT: 2px" align=left SIZE=2>

<DIV><FONT face=Verdana color=#c0c0c0
size=2><SPAN>[Only registered and activated users can see links. ]</SPAN>
</FONT></DIV></FONT></BODY></HTML>

--=====003_Dragon676201373281_=====--

[The-Guardian]

I got that exact email the other day ^^^

[jess~]

[Only registered and activated users can see links. ]

[kalamadeq]

[Only registered and activated users can see links. ]

Return-Path: <[Only registered and activated users can see links. ]>
Received: from info33.gawab.com (mailhost19.gawab.com [66.220.20.19])
by mx.google.com with SMTP id 36si5260840iwn.25.2009.09.28.11.03.17;
Mon, 28 Sep 2009 11:03:18 -0700 (PDT)
Received-SPF: neutral (google.com: 66.220.20.19 is neither permitted nor denied by best guess record for domain of [Only registered and activated users can see links. ]) client-ip=66.220.20.19;
Authentication-Results: mx.google.com; spf=neutral (google.com: 66.220.20.19 is neither permitted nor denied by best guess record for domain of [Only registered and activated users can see links. ]) smtp.mail=WoWgm@blizzard.com
Received: (qmail 5797 invoked by uid 1004); 28 Sep 2009 18:03:17 -0000
Received: from unknown (HELO DEFBAC) (erisve40@gawab.com@93.182.150.68)


learn to spoof headers retards at least your smart enough to use 93.182.150.68 ip which is ipred in sweeden anonymous ip but I bet that email is real haha


omain ID2531125-LRMS
Domain Name:NAMEISP.INFO
Created On:06-Jan-2003 13:50:38 UTC
Last Updated On:07-Feb-2008 10:13:12 UTC
Expiration Date:06-Jan-2017 13:50:38 UTC
Sponsoring Registrar:AB NameISP (R499-LRMS)
Status:OK
Registrant ID:P-DDA636
Registrant Nameomain Admin
Registrant Organization:AB NameISP
Registrant Street1:Radiovagen 2
Registrant Street2:
Registrant Street3:
Registrant City:VASTRA FROLUNDA
Registrant State/Province:
Registrant Postal Code:42147
Registrant Country:SE
Registrant Phone:+46.313011220
Registrant Phone Ext.:
Registrant FAX:+46.317090850
Registrant FAX Ext.:
Registrant Email:registry@nameisp.com
Admin ID:P-DDA636
Admin Nameomain Admin
Admin Organization:AB NameISP
Admin Street1:Radiovagen 2
Admin Street2:
Admin Street3:
Admin City:VASTRA FROLUNDA
Admin State/Province:
Admin Postal Code:42147
Admin Country:SE
Admin Phone:+46.313011220
Admin Phone Ext.:
Admin FAX:+46.317090850
Admin FAX Ext.:
Admin Email:registry@nameisp.com
Billing ID:P-DDA636
Billing Nameomain Admin
Billing Organization:AB NameISP
Billing Street1:Radiovagen 2
Billing Street2:
Billing Street3:
Billing City:VASTRA FROLUNDA
Billing State/Province:
Billing Postal Code:42147
Billing Country:SE
Billing Phone:+46.313011220
Billing Phone Ext.:
Billing FAX:+46.317090850
Billing FAX Ext.:
Billing Email:registry@nameisp.com


LOL

[Rapt0R]

Originally Posted by Rythlas

anyone stupid enough to get Phished deserves it.

Pretty much what he said.

And to the issue of "oldscul" mmowned members:
I was on this site leeching from 2007 (made another acc with a good name coz wanted to contribute, and it almost never had a thread (in Scams section) how to protect yourself from getting scammed or stuff like that.

I learned about the TCG scam, MD scam and backspace scam in 2007.

[tunderofnl]

Why do you do this? Is it ok if when my link is up there and I don't wanna be in there cause of I don't hack mmowned members that you take it out when I'm asking it nicely? (not that its in there anywayz lol)

[Lille Fille]

Add this site:
http:// www. blizzeu-battle. net

I got a ingame message like this:
Hi, Blizzard is about to launch a new mounts, Free trail, For more information, please log in on : http:// www. blizzeu-battle. net


This is a scam of course, don't login or even enter the site!

[Albedo]

Hosts in Iran FTW. Masking links / redirects / url spoofs FTW.

Professionals don't even worry about amateurs.

[explosive]

[Only registered and activated users can see links. ] too

[Caseyy]

[Only registered and activated users can see links. ]

[Only registered and activated users can see links. ]

someone please get this one taken down.

[jess~]

It's what I had explosive..

[the_automatic_man]

Here's a few I've run across :

http://www.blizzardus.com
http://www.worldofwarcrcft.com

glhf