Quote
[14:50:13] <%Remi> have you seen these newest phishan emails
[14:50:14] <%Remi> http://images.fujibayashi.jp/ss/blizzard-kawaii.png
[14:50:15] <%Remi> these
[14:50:18] <%Remi> they're kawaii
[14:50:37] <G-Beast> let seee...
[14:51:39] <%Remi> G-Beast: the funniest thing is it supposedly (not really) links to us.battle.net
[14:51:42] <%Remi> and
[14:51:46] <%Remi> I'm EU
[14:52:08] <G-Beast> lmao
[14:52:12] <Nonoriri> [14:50:13] <%Remi> have you seen these newest phishan emails
[14:52:13] <G-Beast> what a cute blizz response
[14:52:27] <Nonoriri> Doesn't it originate from the actual blizzard domain
[14:52:33] <%Remi> G-Beast: those were plaintext too
[14:52:36] <%Remi> Nonoriri, uhh
[14:52:45] <%Remi> have you ever been into systems administration
[14:52:48] <%Remi> mail server administration
[14:53:00] <%Remi> and SMTP overall?
[14:53:09] <Nonoriri> No
[14:53:13] <Nonoriri> Please explain
[14:53:42] <%Remi> here are the headers
[14:53:55] <%Remi> From: "Blizzard Entertainment" <donotreply@blizzard.com>
[14:53:55] <%Remi> To: <whatever the address is NOT even used for WoW@haruhiism.net>
[14:53:55] <%Remi> Subject: Battle.net Account Management
[14:53:55] <%Remi> Date: Sun, 27 Mar 2011 15:19:28 +0800
[14:54:02] <%Remi> now
[14:54:13] <%Remi> let's see what the other headers say
[14:54:22] <%Remi> Nonoriri,
[14:54:23] <%Remi> Received-SPF: None (no SPF record) identity=mailfrom; client-ip=98.139.212.166; helo=nm7.bullet.mail.bf1.yahoo.com; envelope-from=rossr423@yahoo.com; receiver=spambox@haruhiism.net
[14:54:39] <%Remi> Received: from nm7.bullet.mail.bf1.yahoo.com (nm7.bullet.mail.bf1.yahoo.com [98.139.212.166])
[14:54:41] <%Remi> by mail.fujibayashi.jp (Postfix) with SMTP id E68FF5DDA1
[14:54:44] <%Remi> for <spambox@haruhiism.net>; Sun, 27 Mar 2011 16:19:25 +0900 (JST)
[14:54:48] <%Remi> sure is Blizzard domain there?
[14:55:00] <%Remi> Received: from clbjzbm (rossr423@222.73.27.228 with login)
[14:55:00] <%Remi> by smtp101.mail.bf1.yahoo.com with SMTP; 27 Mar 2011 00:19:21 -0700 PDT
[14:55:03] <%Remi> X-Yahoo-SMTP: svtTtkCswBD3MaCd7RRPeZmtZ3pc
[14:55:06] <%Remi> Sender: rossr423@yahoo.com
[14:55:12] <%Remi> sure is blizzard address
[14:55:46] <%Remi> always check Sender: and Envelope-From:
[14:55:58] <%Remi> checking the mail route is nice, too
[14:56:03] <%Remi> also the link inside that message
[14:56:27] <%Remi> leads to us.battle.net.forums.support-blizzard.com/
[14:56:30] <%Remi> guess what
[14:56:41] <%Remi> it's not a Blizzard site.
[14:57:46] <G-Beast> all blizzard emails are noreplay@blizzard.com
[14:58:16] <G-Beast> reply*
[14:58:48] <%Remi> also lies
[14:58:54] <%Remi> I have letters from blizzard
[14:59:10] <%Remi> originating from <mk.(cut by me).@blizzard.com>
[14:59:25] <%Remi> and <jh(cut by me)@blizzard.com>
[14:59:33] <%Remi> because my friends work for Blizzard Europe
[14:59:38] <%Remi>
[14:59:58] <%Remi> and sometimes send me emails from their @blizzard.com addresses
[14:50:14] <%Remi> http://images.fujibayashi.jp/ss/blizzard-kawaii.png
[14:50:15] <%Remi> these
[14:50:18] <%Remi> they're kawaii
[14:50:37] <G-Beast> let seee...
[14:51:39] <%Remi> G-Beast: the funniest thing is it supposedly (not really) links to us.battle.net
[14:51:42] <%Remi> and
[14:51:46] <%Remi> I'm EU
[14:52:08] <G-Beast> lmao
[14:52:12] <Nonoriri> [14:50:13] <%Remi> have you seen these newest phishan emails
[14:52:13] <G-Beast> what a cute blizz response
[14:52:27] <Nonoriri> Doesn't it originate from the actual blizzard domain
[14:52:33] <%Remi> G-Beast: those were plaintext too
[14:52:36] <%Remi> Nonoriri, uhh
[14:52:45] <%Remi> have you ever been into systems administration
[14:52:48] <%Remi> mail server administration
[14:53:00] <%Remi> and SMTP overall?
[14:53:09] <Nonoriri> No
[14:53:13] <Nonoriri> Please explain
[14:53:42] <%Remi> here are the headers
[14:53:55] <%Remi> From: "Blizzard Entertainment" <donotreply@blizzard.com>
[14:53:55] <%Remi> To: <whatever the address is NOT even used for WoW@haruhiism.net>
[14:53:55] <%Remi> Subject: Battle.net Account Management
[14:53:55] <%Remi> Date: Sun, 27 Mar 2011 15:19:28 +0800
[14:54:02] <%Remi> now
[14:54:13] <%Remi> let's see what the other headers say
[14:54:22] <%Remi> Nonoriri,
[14:54:23] <%Remi> Received-SPF: None (no SPF record) identity=mailfrom; client-ip=98.139.212.166; helo=nm7.bullet.mail.bf1.yahoo.com; envelope-from=rossr423@yahoo.com; receiver=spambox@haruhiism.net
[14:54:39] <%Remi> Received: from nm7.bullet.mail.bf1.yahoo.com (nm7.bullet.mail.bf1.yahoo.com [98.139.212.166])
[14:54:41] <%Remi> by mail.fujibayashi.jp (Postfix) with SMTP id E68FF5DDA1
[14:54:44] <%Remi> for <spambox@haruhiism.net>; Sun, 27 Mar 2011 16:19:25 +0900 (JST)
[14:54:48] <%Remi> sure is Blizzard domain there?
[14:55:00] <%Remi> Received: from clbjzbm (rossr423@222.73.27.228 with login)
[14:55:00] <%Remi> by smtp101.mail.bf1.yahoo.com with SMTP; 27 Mar 2011 00:19:21 -0700 PDT
[14:55:03] <%Remi> X-Yahoo-SMTP: svtTtkCswBD3MaCd7RRPeZmtZ3pc
[14:55:06] <%Remi> Sender: rossr423@yahoo.com
[14:55:12] <%Remi> sure is blizzard address
[14:55:46] <%Remi> always check Sender: and Envelope-From:
[14:55:58] <%Remi> checking the mail route is nice, too
[14:56:03] <%Remi> also the link inside that message
[14:56:27] <%Remi> leads to us.battle.net.forums.support-blizzard.com/
[14:56:30] <%Remi> guess what
[14:56:41] <%Remi> it's not a Blizzard site.
[14:57:46] <G-Beast> all blizzard emails are noreplay@blizzard.com
[14:58:16] <G-Beast> reply*
[14:58:48] <%Remi> also lies
[14:58:54] <%Remi> I have letters from blizzard
[14:59:10] <%Remi> originating from <mk.(cut by me).@blizzard.com>
[14:59:25] <%Remi> and <jh(cut by me)@blizzard.com>
[14:59:33] <%Remi> because my friends work for Blizzard Europe
[14:59:38] <%Remi>
[14:59:58] <%Remi> and sometimes send me emails from their @blizzard.com addresses
None.