Welcome,

Recently there has been an increase about people asking whether a certain email (address) is from Blizzard or not. With this guide I hope to reduce those questions a little.

Feel free to ask questions, but first read all I wrote. Chances are I already discussed the thing you are going to ask about.

Yours sincerely,
Schwick (Shadowsong-EU)
schwickster@gmail.com
MVP (http://forums.wow-europe.com/thread.html?topicId=87109062&sid=1)

Please note, I’m not an Blizzard employee nor related

Blizzard emails will ALWAYS come from <EMAIL>@blizzard.com! Here you can find a list of known email addresses that are valid:

• WoWAccountReviewEU@blizzard.com (used for EU account reviews)
  
• WoWAccountReview@blizzard.com (used for USA account reviews)
  
• Newsletter@email.blizzard.com (used by Blizzard insider)
  
• Newsletters@enews.blizzard.com (used by Blizzard insider)
  (Do note there are more email addresses then these)
  
  So for example email addresses like
  
• blizzard@gmail.com
  
• WoWaccountreview@msn.com
  
• wow_account_review@hotmail.fr
  
• BlizzardVerification@gmail.com
  
• worldofwarcraftaccountrevieweu@gmail.com
  ARE NOT valid!
  
  A list of valid WoW-Blizzard website are:
  
• http://www.wow-europe.com
  
• http://www.worldofwarcraft.com
  
• http://www.worldofwarcraft.co.kr
  
• http://www.wowtaiwan.com.tw/
  
• http://www.wowchina.com/
  
• http://www.blizzard.com / www.blizzard.co.uk / .de / .fr / etc
  
• http://www.wowarmory.com
  
• http://www.diablo3.com
  
• http://www.starcraft2.com
  
• http://www.battle.net / eu.battle.net / us.battle.net
  

There are a couple of things that will instantly pop up the question if a mail is from Blizzard or not. Most of the times fake emails will ask for your password; Blizzard will NEVER asks for these things! DO NOT reply to these kind of emails!

Blizzard however will sometimes ask for things like:

• Your account details
  
• Other Character details
  Etc..
  
  Unless the email you received is a direct response to an email you have sent, never reply to such emails. Use the web-form found here: http://www.wow-europe.com/support/securitywebform/securitywebform.html?lan=en
  
  You can also use the above mentioned web-form to contact Blizzard in case you are unsure about the authenticity of an email from Blizzard.
  

Sometimes an email address may look like it comes from Blizzard while it's not. For example most common fake emails use noreply@blizzard.com. While this email address is used by Blizzard, it's not always valid. This is called spoofing.

To make sure it is really the email address it claims it is, try checking the header-data. The header-data can be seen by checking the advance details of the email (also sometimes called “Original email”).

In the header-data there should be “Return-Path”. A spoof will return another email address then the original email said it did. For example the email says noreply@blizzard.com, but the header-data says hax0r@IstealaccountKK.no.

SPF, or Sender Policy Framework, checks to see if the email is indeed from Blizzard. The Received-SPF in the email details should read “Pass”. The SPF can be seen by checking the advance details of the email (also sometimes called “Original email”)

For more information regarding SPF, see http://en.wikipedia.org/wiki/Sender_Policy_Framework

The mail sometimes contains links. BEWARE that you are sure it’s a valid link. For example:

• WoWaccountReviewEU@blizzard.com (while it links to worldofwarcraftaccountrevieweu@gmail.com)
  
• https://www.wow-europe.com/account/ (while it links to www.imstealingyourpassword.com)
  
  Always double check the link you are going to click! Also note the difference between a “0” (zero) and “o” (for example w0w-europe.com) or a “1” (one) and “l” (for example 1inks.wow-europe.com). Also as of lately scammers use www.vvovv-europe.com & www.vvorldofvvarcraft.com (two "V"'s next beside each other instead of a "W").
  
  This is also known as “Phishing”. For more details read this page: http://en.wikipedia.org/wiki/Phishing
  
  To make sure a login-link is valid; Blizzard always used a secure connection. You can recognize this by the link provided is “Https://”. Both Firefox and Internet Explorer display these website locations with a lock-icon.
  
  To make sure the website itself is valid; Blizzard's website gets verified by “Thawte Consulting CC”. You can see upon clicking the link. Here's an example: http://img509.imageshack.us/img509/8048/verifiedfw5.jpg
  

If you are still not sure about the email address you can check some technical information.

Blizzard US
DNS: ob3.blizzard.com
IP: 216.148.0.68

Blizzard EU
DNS: eu-smtp02.blizzard.com
IP: 80.239.172.105
Or
DNS: eu-smtp01.blizzard.com
IP: 80.239.174.216

Blizzard insider
DNS: info.cme.vugames.net
IP: 12.129.240.41
Or
DNS: email.blizzard.com
IP: 12.129.200.219

OK here’s an example of an email scam.
http://img99.imageshack.us/img99/741/fakewlkuj9.jpg
http://img99.imageshack.us/img99/5829/fakewlk2fb6.jpg

As you can see in the images this a beta invite for WLK (or so it seems). But do note the following things:

• Typo in the email: Worlf of Warcraft
  
• The URL is a spoof (check the link in the email and note the link left under)
  
• The header data says it’s from wotlkBETA@blizzard.com but the received from says another address
  
• The received SPF says it’s not permitted nor denied. A real Blizzard email shows up as accepted.
  
  So remember, keep your eyes out for such things!
  
  Here’s a fun test to test your knowledge: http://www.sonicwall.com/phishing/index.html
  

Q1: Blizzard has sent me an email with a link linking to a survey but it isn't a blizzard site. Is this a real Blizzard email?
A1: Yes, sometimes Blizzard sends surveys that aren't on the Blizzard website. The website used is http://www.otxresearch.com/. Blizzard usually announces when these surveys start. As always, make sure to think twice before clicking links!

Q2: How can I protect myself against Phishing?
A2: First off, always double check a link. Simply do this by hovering over it and check what the footer displays. If you also use Firefox or Internet Explorer 7 (or higher) you have a build-in phishing checker. The browser will notify you then if the website is fake.

I would say start using Gmail. So far it blocks all fake emails and lets real emails pass. Here's an example of a fake WLK beta invite:http://img410.imageshack.us/img410/7725/fakemailcz0.jpg

Along side that, it has all the tools to fight spoofers and hackers and such.
https://www.google.com/accounts/NewAccount

You can always ask questions here or use the web-form found here: http://www.wow-europe.com/support/securitywebform/securitywebform.html?lan=en

Also here’s a blue-post you could read: http://forums.wow-europe.com/thread.html?topicId=286852043&sid=1

Always keep your PC/Mac protected with the latest updates and security programs. More a guide about that, read this: http://forums.wow-europe.com/thread.html?topicId=273198555&sid=1

---

Q u o t e:


You should explain how to check this, many players simply don't how how to dig this deep...

Edit: Btw, we can't see this thread on the forum...
Edit2: Ah, there it is :(

---

---

Q u o t e:
This sticky can probably be locked, or merged with : http://forums.wow-europe.com/thread.html?topicId=2111545640&sid=1

No need to keep open any more than we need to TBH.
It's getting sort of crowded up top.

---

---

Q u o t e:
betaSignup@blizzard.com

Is this a blizzard email?

---