Monday, July 4, 2011

Zhang and Battle.net

Have you gotten this e-mail:

Hello zhang,

Welcome to Battle.net!

You have successfully created the following Battle.net account:

[removed]

The Battle.net account is a centralized account system that will let you manage all of the Blizzard Entertainment games you play, including World of Warcraft and future games, in one place without having to remember multiple sets of login information.

We highly recommend that you take this opportunity to verify your e-mail address. Verifying your e-mail address will unlock extra Battle.net account features, including the ability to register Blizzard games you own so that you can download them, free of charge, any time you want. To do so, simply click here:

https://sea.battle.net/account/email/confirm.xml?ticket=[removed]

In addition, you may also merge any World of Warcraft accounts you play with this Battle.net account. After merging, you will log in to the game and its associated online services such as World of Warcraft Account Management, the World of Warcraft Forums, and the World of Warcraft Armory, using your Battle.net login information. You can begin the account merge process at the Battle.net account homepage, located at http://www.battle.net/account.

Please retain this e-mail for your reference.

For more information, click here for answers to Frequently Asked Questions or to contact the Blizzard Billing & Account Services team.

Sincerely,
The Battle.net Account Team
Online Privacy Policy

Well, you're not alone. Apparently, zhang has been submitting new account creations for a bunch of e-mail addresses.

I'm not sure where zhang got these e-mail addresses. Most likely, from someone's address book, either a big name company or your best bud who just downloads too many questionable applications. Some have claimed it's part of the Sony hack, but this is pure speculation.

Nevertheless, this is a REAL e-mail from Battle.net. The links do not redirect, and the header is from an actual Battle.net origin. sea.battle.net is for the South East Asia servers. Your e-mail address probably didn't get hacked (if you use Gmail, you have a nice little option to see last account activity; it's probably pretty boring...).

Here's what you should do:

1. If you're ever wanting to create a Battle.net server, contact customer support (http://us.blizzard.com/support/index.xml) and have them fix the account for you.

2. DO NOT CLICK THE LINK; DO NOT POST THE LINK TO A FORUM OR BLOG; This link activates the account for that user (Zhang Somethingorother). If you do, you'll have to resort to step 1.

3. If you really don't care, delete the e-mail and get on with your life. Stop downloading questionable applications, and update your virus scanner once in a while.

I'm personally disappointed to see how Battle.net support and other people are reacting to this. Reaction 1: It's a phishing attempt! Reaction 2: You got hacked! Reaction 3: Anything but us letting people try to sign up for a billion accounts with the same name, etc.

Why, though?

Why is zhang trying to create a Battle.Net account with my e-mail address?

Because zhang wants you to click that link and activate the account, and let him/her/it play WoW nonstop under a multitude of accounts that wouldn't otherwise be used by people for Battle.net. Since WoW released F2P, I imagine gold farming has become a much more tempting vocation, and perhaps a bunch of accounts would help continue to do so, in case one account gets banned, or there's some sort of limits put on each account. And then, in the end, if anything bad happens, it's on you, not zhang.

Zhang will want to get a lot of accounts, in case there's a few people who are actually smart and scrutinize things a bit.

So stop the gold farming and don't click that link (even if you did sign up for Battle.net :P)!

2 comments:

barefootwriter said...

Thank you for creating the first reasonable explanation I've seen for this phenomenon.

I get a lot of WoW phishing e-mails, but this one was different because it was legit. And that worried me, and sent me searching.

First, I tried to manually go to battle.net and take control of the account using the lost password function. But I couldn't get a match using the information I had.

Then I went looking for answers.

I use LastPass to create secure, unique passwords for everything, but I still had a moment of panic at Battle.net's overblown claims of phishing/data breaches/etc.

So I immediately changed my already strong, unique Gmail password to another strong, unique Gmail password and ensured my e-mails weren't being forwarded.

And then I came across your post. Thanks for clearing things up. I feel much better now. :)

Jacob P. Silvia said...

No problem. It was my irritation how the Battle.net community (especially the moderators) were handling this that got me to write this up.

After I wrote the post, I also came across information that zhang was doing a mass registration to figure out which e-mail addresses wouldn't register for new Battle.net accounts (i.e., e-mails already registered). These, then, would get false Battle.net e-mails from zhang, which would take the user to a fraudulent Battle.net login page.