107624-recent-phishing-emails-they-look-almost-legit

== Content ==
			
Hi all!
I just wanted to share some info with you guys about the latest phishing emails I've received. I guess most of you are already skilled enough to tell a real email from a spoofed one, but these latest ones look almost legit and it's easy for someone to get fooled. I started to receive them when Wildstar was about to go live and have gotten new ones only whenever there have been new content released in Wildstar (I have tagged the sender as a spammer, so I get them to my spam folder and I might therefore not see all of them. I might therefore get the wrong statistics on how often they send them out, but it seems like I only get them with new content releases). I noticed the first email because I received an email encouraging me to set up my monthly subscription, but it was sent about a week after I had already done so I should therefore not have received such email if it was from a legit source. Upon checking the header, I noticed that the sender was transactional@email-wildstar-online.com and not any of the real addresses (the real addresses should end in @ncsoft.com, @arena.net or @carbinestudios.com). I have reported the emails I got to the Wildstar dev team and they have confirmed that @email-wildstar-online.com is a scam address.
 
What these scammers do is to copy images and text from the real Wildstar page and the emails therefore look almost legit, however all links in the email point to the phishing site. The latest one I found in my spam folder was an email informing me about the Sabotage release and, as you can see in the screen cap I've provided of the email, it does look almost real. Do take note that it's a different reply-to address compared to the senders address and that it does not come from any of actual addresses related to Wildstar.
 
 
 
If you have received any email like this, then do NOT click any links in it; just report the email as junk and delete it. I also strongly urge all of you to use a unique password for Wildstar, to use the authenticator, to use an up to date anti-virus program and to regularly scan for malware.
If you have already clicked any links in an email from @email-wildstar-online.com, then I strongly recommend that you change your Wildstar password, scan for malware on your computer and, if you deem it necessary, that you contact the Wildstar team for assistance on how to secure your account.
 
 
Easy ways to tell if an email is real or not:
Check the address and the reply-to addresses. If they do not match it's a warning signal that something is phishy (it can still be legit, but it often is a clear sign that someone wants to impersonate someone else).
Check the sender address. Is it different compared to the real address? if yes, then it's a scam. If you have trouble spotting subtle differences then one way is to add the address from an email you know comes from a legit source to your contact list. Emails from people in your address book are usuzlly marked in someway by your email program to make it easier for you to see that they are legit. I'm using Thunderbird and you can see in the screen cap above that neither the sender address nor the reply-to address have a yellow star next to it (the star is unfilled in the picture). I have the legit WIldstar addresses added to my contact list so all legit emails I get will have a yellow star next to the address (you can also notice that the star next to " me" on the receiver line in the picture is unfilled, that's because I haven't added my own address to my address book).
Hover (but do NOT click) the links in the email, if you have your system set up to show status information then the link address will be shown (which can be seen in the lower portion of my screen-cap above; I was hovering the "Available Now" button as I took the screenshot). If the links point to anywhere else than http://www.wildstar-online.com, then it's a scam. They can ofc point to places such as http://forums.wildstar-online.com or http://support.wildstar-online.com; the thing to look for is that the base address is .wildstar-online.com and nothing else. The phishing email above points to link.email-wildstar-online.com, which looks fairly similar to the real address but, as you will notice, the base part of the address will be .email-wildstar-online.com and not .wildstar-online.com. It's the preceding dot which tells where the base address starts and not the dash.
For less serious phishing attempts, you can also check for bad spelling or bad grammar. Real companies makes an effort to spell correctly and bad language is usually a sign of a scam email. In this case, they have copied most/all of the text from the Wildstar homepage and thus the spelling and grammar is done by Carbine and can therefore not be used as a way to detect phishing.
If you are in doubt whether an email is legit or not, then it's always better to assume that it's a scam and to contact the support team for assistance rather than just clicking away on links.
 
Stay safe and have fun in Nexus.	
----
			good find, hope it help people around here :)	
----
			
This seems to pop up every time a marketing email goes out.
 
See reply #51 from a moderator.  It's legit.  email-wildstar-online.com appears to be a marketing company.  Not phishing.
 
https://forums.wildstar-online.com/forums/index.php?/topic/47578-warning-possible-phishing-attempts-have-started/page-3	
----
			
{| class="blockquote"
This seems to pop up every time a marketing email goes out.
 
See reply #51 from a moderator.  It's legit.  email-wildstar-online.com appears to be a marketing company.  Not phishing.
 
https://forums.wildstar-online.com/forums/index.php?/topic/47578-warning-possible-phishing-attempts-have-started/page-3
----
			
"Regardless, I'd consider it extremely bad practice to use an ad firm to send out marketing emails;"
 
this right here. i wil never open crap like that.	
----
			
Hey everyone, we want to thank you for your vigilance, but this is a 100% legit email. It's not uncommon for companies such as ourselves to work with a third party mailing service for a variety of reasons.
 
~Team WildStar 	
----
			
{| class="blockquote"
Hey everyone, we want to thank you for your vigilance, but this is a 100% legit email. It's not uncommon for companies such as ourselves to work with a third party mailing service for a variety of reasons.
 
~Team WildStar
 
----
			
{| class="blockquote"
Whether that is true or not, i would still consider it bad practice to advertise that way.  For an official  advertisement from the actual company it should have a banner, picture or poster.  And underneath it I think it should say for "For more information visit the wildstar online homepage".  And thats it...no links PERIOD, not even a link to the official wildstar homepage on the email.  If phishing scammers get word that WS emails out official advertisements this way, whats the stop them from copying the message format for their own phishing attempts?
----
			
{| class="blockquote"
Hey everyone, we want to thank you for your vigilance, but this is a 100% legit email. It's not uncommon for companies such as ourselves to work with a third party mailing service for a variety of reasons.
 
~Team WildStar
 
----
			
{| class="blockquote"
It's also basic email scamming 101. Plus, many of the internet users are nowadays doing all they can to block trackers and redirects for safety reasons so legit ad firms really need to change the way they work if they want to continue. I'm by no means an expert on the subject, but it should be fully possible to get the same info that the ad firm wants without making the emails look like phishing emails; wouldn't a link to the actual website with a referral tag at the end suffice (e.g. link to "www.wildstar-online.com/newcontent&referral=email" instead of "www.malicious-looking-addres.com/tracker-inject")?
----
			
{| class="blockquote"
Links are required to track clicks and visits.
If they want to know how many people actually read the email and follow through they need links with specific parameters or callback URLs.
Basic email marketing 101
----
			Wow, that one looks super legit.	
----
			
{| class="blockquote"
wildstar-online.com
 
wildstar-online.com/en/drops/2/sabotage/   (thats the link in the <learn more> button, but i had to take out the http)
 
bottom of the page add in a "you are visitor #100" for tracking purposes.
 
 
That right there tells you that i skipped school the day they taught "basic email marketing 101".  But that's because i had gone to the bookstore that day to pick up my copy of "how to avoid phishing scams for dummies" and so that i could buy a roll of tin foil and an instruction manual on how to fold hats.
----