Scammers target Diablo 3 – be warned for this fake e-mail!

Scammers seem to never give up in finding methods to lure people into their tricks. Their latest interest is in Diablo 3, specifically the usernames and passwords of the gaming service Battle.net, required to play Diablo 3. The immense popular PC game from Blizzard is apparently so popular that it’s interesting enough to send millions of spam mails to random users in order to try to steal details of their Battle.net account.

They spammers are sending out so called phising mails where they claim that you are trying to sell your Diablo 3 account and that you need to verify your account again. The link looks legitimate, but once clicked the user is directed to a website hosted on a domain (gxrk.info) that is registered with fake details.

The scam seems to be coming from Chinese based spammers as the mail comes from an e-mail address using a Chinese free mail service,  the domain is registered using a Chinese free e-mail service and the same e-mail address is listed on dozens of other Chinese websites.  Here is a verbatim copy of the e-mail that has been sent out.

You can confirm that you are the original owner of the account to this secure website with:

https://us.battle.net/login/en/?ref=http%3A%2F%2Fus.battle.net%2Fd3%2Fen%2Findex&app=com-d3

Login to your account, In accordance following template to verify your account.

* First and Surname
* Secret Question and Answer
Show * Please enter the correct information

Greetings!

It has come to our attention that you are trying to sell your personal Diablo III account(s).
As you may not be aware of, this conflicts with the EULA and Terms of Agreement.
If this proves to be true, your account can and will be disabled.
It will be ongoing for further investigation by Blizzard Entertainment’s employees.
If you wish to not get your account suspended you should immediately verify your account ownership.

If you ignore this mail your account can and will be closed permanently.

Once we verify your account, we will reply to your e-mail informing you that we have dropped the investigation.

Regards,

Account Administration Team
Blizzard Entertainment
http://www.blizzard.com/support/
Diablo III , Blizzard Entertainment 2012

To trick users into filling in details, the spammers have created a website that resembles the Battle.net website. Once a (fake) e-mail address and username is entered the scammers also ask for additional details such as your first and last name and an answer to a security question.  Chrome and Internet explorer users receive a warning when they click on the link, Firefox seems not have blacklisted the domain yet.