Beware! 'Jagex' scam email!

[SDGDIRKSDG]

Ok, [removed] is a phising website wich was created by [removed]. It was ment to be an easy way to send fake phiser emails to allot of Rs players. These email looked very real and still do, and those guys made billions of money by screwing other runescape members!

 

Since the new owners: [removed] bought the domain and all rights they screwed all members on the site, making them pay 200m for ultimate membership. (Yes I know its their own damn falt to even be member in a phising community.)

 

Heres how the emails look like:

 

See that they look pretty real. And allot of people fall for them!

 

I dont know if this is they right place to post this, but I will be posting this on every big forum related to RS.

 

Thanks for reading and remember dont fall for this emails!! Jagex will never email you about offences!!

Edited March 7, 2011 by tripsis
Names removed

[BBK]

I got this email, [bleep] knows how they got my email adress I don't type it into any forums or anything, it's registered to my account but there's no way for scammers to find that out, maybe they are just randomly sending it to any email they can get there hands on

 

edit: I know what it is, I had to enter my email to register on smokin mils thats prob where they're getting it from

[Instinctive]

I had someone try to pull this on me in game with the name of "JMod Alice" or something like that...over PM...

 

 

HAHAHA

 

But...beware I suppose.

[VoidRealm]

I've had four of these within a few minutes of each other, wow, they really aren't trying anymore :thumbup:

[Blyaunte]

Oy! Am I a Pmod yet?

 

When am I gonna get THAT email?!?!?

 

:lol:

[cookiestealer222]

This is probably a dumb question, but I was surprised that when I logged in today to find I didn't have e-mail or security questions set. This is strange because I thought I set security questions like 5 years ago...

 

So when I input a new e-mail address I was told an e-mail would be sent and to follow the instructions. It was from RuneScapeNoReply@jagex and just wanted me to click on a link starting with secureDOTrunescapeDOTcom

 

Any problems with these e-mails? Never asked to input my user name or password. I also used my cellphone to check the e-mail, so hoping it's legit.

 

Also said "registered trademarks of Jagex Ltd in the United Kingdom and trademarks used in other countries of the world." at the end. Another member said this isn't right?

[Drazhor]

Hmm...I can't gain access to my jagex emails right now (cause I may or may not have deleted them all :P*

but yeah that bottom thing seems to be found on the fakers so I'd wait and see if you get another email from them later today about it

[Stev]

All you have to do... Double check the URL by hovering your mouse over it.

[cookiestealer222]

Sorry, I don't see the image you just posted. I think sometimes they don't get pass the government firewall here in China.

[Krampell]

I'm kinda sad that I never get any mails like this ;_;

I want to see them try.

But fail miserably.

[Dakr06]

I went to the page, but my internet said there was no such page so nothing happened with it.

[Soma2035]

In response to Tripsis,

 

You said that one of the few reasons that Jagex could rarely send e-mails for was for recovery quests. Well, I just got the following e-mail:

 

Dear Player,

 

This is an automated email from Jagex Ltd., makers of RuneScape and FunOrb, sent because you submitted a Password Recovery request for this account.

 

Unfortunately, your recovery request has been denied.

 

To find out the reason for your request being denied, please enter your username and tracking ID on the Track Recovery page: https://[LikelyScam]/m=weblogin/redirect.ws?mod=accountappeal&dest=trackinginput.ws

 

 

 

Please read it carefully because it contains important information about how you can improve your chances of recovering your account.

 

To make account recovery easier in the future, please ensure that you have an email address registered. You can register an email address here: https://[LikelyScam]/m=weblogin/loginform.ws?mod=email-register&ssl=1&expired=0&dest=set_address.ws

 

 

 

Many thanks,

Jagex Ltd.

 

You do not need to unsubscribe, as we have not added this email address to any mailing lists.

 

Copyright © 1999 - 2011 Jagex Ltd. Jagex, RuneScape, FunOrb, War of Legends and Stellar Dawn are registered trademarks of Jagex Ltd in the United Kingdom and trademarks used in other countries of the world.

By using our service you are agreeing to our Terms and Conditions and Privacy Policy.

 

I'm not sure whether someone's trying to hack me by recovering my account, or by sending me a fake e-mail now that they know the only legitimate things that Jagex would e-mail for. :angry:

[Rosanante1]

Also,

 

If you're British, the word 'offense' used in the scam is spelt 'offence'.

 

As JaGex is based in the UK, the American spelling gives it away.

[amitoz]

In response to Tripsis,

 

You said that one of the few reasons that Jagex could rarely send e-mails for was for recovery quests. Well, I just got the following e-mail:

 

Dear Player,

 

This is an automated email from Jagex Ltd., makers of RuneScape and FunOrb, sent because you submitted a Password Recovery request for this account.

 

Unfortunately, your recovery request has been denied.

 

To find out the reason for your request being denied, please enter your username and tracking ID on the Track Recovery page: https://[LikelyScam]/m=weblogin/redirect.ws?mod=accountappeal&dest=trackinginput.ws

 

 

 

Please read it carefully because it contains important information about how you can improve your chances of recovering your account.

 

To make account recovery easier in the future, please ensure that you have an email address registered. You can register an email address here: https://[LikelyScam]/m=weblogin/loginform.ws?mod=email-register&ssl=1&expired=0&dest=set_address.ws

 

 

 

Many thanks,

Jagex Ltd.

 

You do not need to unsubscribe, as we have not added this email address to any mailing lists.

 

Copyright © 1999 - 2011 Jagex Ltd. Jagex, RuneScape, FunOrb, War of Legends and Stellar Dawn are registered trademarks of Jagex Ltd in the United Kingdom and trademarks used in other countries of the world.

By using our service you are agreeing to our Terms and Conditions and Privacy Policy.

 

I'm not sure whether someone's trying to hack me by recovering my account, or by sending me a fake e-mail now that they know the only legitimate things that Jagex would e-mail for. :angry:

 

Looks legit.

 

 

...

 

 

Too legit.

[tripsis]

I'm not sure whether someone's trying to hack me by recovering my account, or by sending me a fake e-mail now that they know the only legitimate things that Jagex would e-mail for. :angry:

Well the good news is that as long as your recovery questions are totally secure and unguessable - even by family/friends - you have nothing to worry about. People can submit requests all they like and still shouldn't be able to gain access to your account.

[Hegelstad]

God this [cabbage] sucks, i've got like 20+ phising mails the last month, its really pissing me off, can't unsubscribe either, does anyone know the sender? It is spoofed... But i could put a IP ban over my network.

[Krampell]

Yay, put up my msn address on tif and now they start pouring in :)

[Stev]

Yay, put up my msn address on tif and now they start pouring in :)

TY for proving my point a few pages back. ;).

[Blyaunte]

Yay, put up my msn address on tif and now they start pouring in :)

TY for proving my point a few pages back. ;).

 

Which was what, exactly? That you look cute in little girl's makeup? :lol:

[joey11223]

I'm not sure whether someone's trying to hack me by recovering my account, or by sending me a fake e-mail now that they know the only legitimate things that Jagex would e-mail for. :angry:

Well the good news is that as long as your recovery questions are totally secure and unguessable - even by family/friends - you have nothing to worry about. People can submit requests all they like and still shouldn't be able to gain access to your account.

 

I'm not sure... I stopped playing for a very long time and forgot my password. I also forgot the recovery question. Now I did guess the answer as to what I'd normally put, but I don't usually select the question it presented me with so i wasn't sure. In the comments box I simply stated my position and that some details like date of account creation and stuff had been forgotten but I knew the first event I'd gotten an item from and such like. I got my password back within a minute so...not sure if I was lucky or what, very thankful either way.

 

I actually fell for this email, seriously facepalm. It's just that it said www.runescape.com/(the rest of it) and the site seemed totally legit. I logged in via it's link and just had a look and my old offences were there and not the new one it claimed. I quickly realised and changed my pass the second afterwards on my proper bookmark. I had another one in my junk which said www.runescupe.com or something(a letter was wrong or an extra one added) so that was clearly a scam, but the first one wasn't in my junk folder and I wasn't concentrating.

[Barihawk]

I got a very clever one that exactly mimics the password recovery email to the letter. The only difference from the actual accounts page (which is recreated perfectly is a hyphen instead of a single period. I fell for it and lost the fury I had been wearing (Guys, do not underestimate the bank pin, it saved me from total loss). Comparing the fake email with the actual password reset email from Jagex it was a near perfect forgery. And I do have the receiver of the gear red handed (I reset password as he was drop trading, so he couldn't log in to take his username off my friends list).

[deaddutch]

Got another fake email today .... about the fact that my account is still being sold or traded in the real world. Checking the official Runescape shows absolutely nothing.

The link they give in the mail "looks" real, with good spelling of Runescape. Ones you click on the link, the site changes 1 letter, or adds an extra one. THank god firefox reported the site as fake already <3:

 

Any way to stop this [bleep] [bleep] person from mailing me? Besides from getting a new email-address?

[Stev]

Got another fake email today .... about the fact that my account is still being sold or traded in the real world. Checking the official Runescape shows absolutely nothing.

The link they give in the mail "looks" real, with good spelling of Runescape. Ones you click on the link, the site changes 1 letter, or adds an extra one. THank god firefox reported the site as fake already <3:

 

Any way to stop this [bleep] [bleep] person from mailing me? Besides from getting a new email-address?

Block them and remove your e-mail from Tip.It. ;).

 

 

Edit: Notable stuff in bold.

X-Message-Delivery: Vj0xLjE7dXM9MDtsPTA7YT0wO0Q9MjtTQ0w9NA==

 

X-Message-Status: n

 

X-SID-PRA: [email protected]

 

X-AUTH-Result: NONE

 

X-Message-Info: Removed.

 

Received: from STEALTH.Webs.Net.PK ([91.215.157.142]) by BAY0-MC4-F39.Bay0.hotmail.com with Microsoft SMTPSVC(6.0.3790.4675);

 

Sat' date=' 19 Mar 2011 23:06:21 -0700

 

Received: from [b']runesca4[/b] by STEALTH.Webs.Net.PK with local (Exim 4.69)

 

(envelope-from <[email protected]>)

 

id 1Q1BmT-0000qi-0c

 

for [email protected]; Sun, 20 Mar 2011 09:06:25 +0300

 

To: [email protected]

 

Subject: Real Word Trading Investigation: RuneScape

 

From: [email protected]

 

Content-type: text/html

 

Message-Id: <[email protected]>

 

Date: Sun, 20 Mar 2011 09:06:25 +0300

 

X-AntiAbuse: This header was added to track abuse, please include it with any abuse report

 

X-AntiAbuse: Primary Hostname - STEALTH.Webs.Net.PK

 

X-AntiAbuse: Original Domain - hotmail.com

 

X-AntiAbuse: Originator/Caller UID/GID - [545 541] / [47 12]

 

X-AntiAbuse: Sender Address Domain - STEALTH.Webs.Net.PK

 

Return-Path: [email protected]

 

X-OriginalArrivalTime: 20 Mar 2011 06:06:21.0644 (UTC) FILETIME=[EF81F0C0:01CBE6C4]

 

They are also using http://www.emkei.cz, HELO - http://www.hostmonster.com, rrunesc - http://alpha.dollareshop.com (Used the most), dvinasco -http://www.serv1.bindhosting.com, http://www.bingo-hosting.com/, http://www.000webhost.com, http://www.mxzon.com.

 

Block those and you're all set. :P. Well, until they move on to other hosts. I doubt they have a list of the e-mails saved... Seeing as how most e-mails are sent to like 3 people at a time. Probably just copied and pasted from TIF / Zybez / etc. ;).

Edited March 20, 2011 by Wicked_

[Salad]

 

Just got this in my inbox.

 

[cabbage] just got real.

 

The email looks so legit, the top and bottom image are actual images hosted on jagex.com for email pictures.

 

http://www.jagex.com/img/email-register/runescape/header.jpg

http://www.jagex.com/img/email-register/runescape/footer.jpg

 

Looks like they took the email from Jagex when registering a new email address, changed it and put the phishing link in it.

Edited March 20, 2011 by Salad

[Wter]

Just lost my bank (worked 7 years on it) becouse of this email...