Account Appeal Denied Email

[MonkeyChee]

Hello, I have received an email from '[email protected]' saying that a password recovery request was denied for my account. I have not asked for a password recovery, and I have gotten emails similar to this and I'm aware they are usually scams, however I would like to know if this one is real.

 

I ask this because this morning my passwords for both my email account and my facebook account had seemingly been changed (though nothing deleted etc on them), and when I recovered them this email was in my inbox. I have run a virus scan etc and nothing has come up, I don't recall downloading anything suspicious recently or anything. Let me know if any more information is needed, thanks.

[GlowinRedM]

do they ask you to go to a link or send a username/password? if so then it's likely just phishing spam, i get them occasionally

[MonkeyChee]

There is a link, starting with https://[LikelyScam]..., and it doesn't ask for my username/password.

[Promise]

One quick way to see if the site is legit is to look for the copy right logo on the bottom of the page by the dates.

[Howlin0001]

While the link might be say it's to the real runescape website, if you hover over the link and right click it and copy the link. Paste that into your browser address bar and you will see the link that you would be brought to if you click on the link. It would normally be something like https://[LikelyScam]/whatever/whatever.X and X could be some domain.

[Tim]

It's possible someone tried to gain access to your account but failed to steal it.

 

 

IN SAYING THAT, someone also created a fake email seeing like it. the REAL Appeal Deny does not require you to enter your password at all, only your Username and checks the tracker ID via the link from the email. So if it IS asking for a password, it's a load of shit. (I had to do this 27 times to get Limit Storm back :\ )

[The Observer]

If it contains a link, then it's most likely fake.

[Bxpprod]

Phishing scam.

 

K.

[Ellac]

This is a quote from this Wiki article on Phishing Emails

Phishing emails are very easy to spot if you know what you are looking for. Jagex rarely contact players through their personal emails, the exceptions are newsletters, billing support, and password requests, otherwise we use the in game mail box. If you do happen to receive an email from Jagex, you will be able to tell it's genuine by looking for the following points;

 

1. E-mails sent by Jagex will always originate from @email.Jagex.com or @email.runescape.com addresses.

 

2. Any emails sent by a Jagex representative will have the correct spelling and use of grammar. If the email you're reading has any spelling mistakes or strange sentence structures, be cautious.

 

3. Jagex employees will NEVER ask a player for your password. We have no need for it.

 

4. Phishing emails may offer free membership, Player Moderator Status, free in game items and beta access. If it sounds too good to be true, it usually is. Check the validity of these offers on the official RuneScape website, and also confirm the senders e-mail has not been "spoofed"(more information on this below).

 

5. In most cases phishing e-mails will contain links to malicious websites. Do not follow these links without double checking the hyperlink before you click it (more information below). The official link that takes you to the game page is http://www.runescape.com/game.ws?j=1, so if it does not look like this be wary.

[cultjunky]

HI Monkeychee,

 

I had the same thing happen to me on Sunday 20th, in addition, I had my p/word for here at tip.it reset too. In total there were four recover request denied emails.

 

I also haven't downloaded anything new recently, nor had any suspicious emails.

 

One thing to note though, I received a google mail reset notification, in Finnish.

 

Seems to be doing the rounds, eh?

[MonkeyChee]

Thanks for the replies,

 

While the link might be say it's to the real runescape website, if you hover over the link and right click it and copy the link. Paste that into your browser address bar and you will see the link that you would be brought to if you click on the link. It would normally be something like https://[LikelyScam]/whatever/whatever.X and X could be some domain.

 

The text in the email and the page it goes to do seem to be the same, going to (what seems to be at least) a legitimate runescape page about account recovery.

 

It's possible someone tried to gain access to your account but failed to steal it.

 

 

IN SAYING THAT, someone also created a fake email seeing like it. the REAL Appeal Deny does not require you to enter your password at all, only your Username and checks the tracker ID via the link from the email. So if it IS asking for a password, it's a load of shit. (I had to do this 27 times to get Limit Storm back :\ )

 

That's what I'm thinking, and it's not asking for a password or anything.

 

 

This is a quote from this Wiki article on Phishing Emails

Phishing emails are very easy to spot if you know what you are looking for. Jagex rarely contact players through their personal emails, the exceptions are newsletters, billing support, and password requests, otherwise we use the in game mail box. If you do happen to receive an email from Jagex, you will be able to tell it's genuine by looking for the following points;

 

1. E-mails sent by Jagex will always originate from @email.Jagex.com or @email.runescape.com addresses.

 

2. Any emails sent by a Jagex representative will have the correct spelling and use of grammar. If the email you're reading has any spelling mistakes or strange sentence structures, be cautious.

 

3. Jagex employees will NEVER ask a player for your password. We have no need for it.

 

4. Phishing emails may offer free membership, Player Moderator Status, free in game items and beta access. If it sounds too good to be true, it usually is. Check the validity of these offers on the official RuneScape website, and also confirm the senders e-mail has not been "spoofed"(more information on this below).

 

5. In most cases phishing e-mails will contain links to malicious websites. Do not follow these links without double checking the hyperlink before you click it (more information below). The official link that takes you to the game page is http://www.runescape.com/game.ws?j=1, so if it does not look like this be wary.

 

I took a look at that earlier, from their descriptions it doesn't seem to be fake. I have had other e-mails (from different addresses) that were clearly fake, spelling errors, links going to different pages etc. but this seems real.

 

After looking a bit on Google, a few people do seem to have had this e-mail (exact wording/links) when they have been unsuccessful in their attempts to recover an account. So I guess it could well be real and someone (somehow) has tried to recover my account after getting into my emails. I've changed all my passwords/recivery questions now anyway.

[Rotterdam]

This is the type of account hacking where they use your Facebook account to login to RuneScape. Or by hijacking your e-mail address which seemingly makes it easier to recover an account.

[MonkeyChee]

This is the type of account hacking where they use your Facebook account to login to RuneScape. Or by hijacking your e-mail address which seemingly makes it easier to recover an account.

 

That would make sense (though as I say I don't know how they got into my email account), annoyingly I can't log-in to the runescape site at the moment, not a password issue as I can log in in-game, but the pages aren't loading with the new site layout.

[lordkafei]

There is a link, starting with https://[LikelyScam]..., and it doesn't ask for my username/password.

 

Its the ending part that is significant. Usually phishers set up in the co.cc domain.

 

Your email is almost certainly a phishing attempt. I wouldnt worry about it unless I had something in my secure Runescape inbox. And I would never click on the links.

 

Common themes:

 

RuneScape Account-Notice

RuneScape Account - login validation

Members Loyalty Programme invite NO:00180266

Members Loyalty Programme invite NO:00343224

Your RuneScape account has been disabled

RuneScape Account - Final Warning

 

There is a running thread where I (and others) post phishing attempts. Ive gotten 8 more since the last time I posted; I suppose Ill be posting again in the next day or two.

[D. V. Devnull]

Monkeychee, If you could post a copy of the message source and headers in a quote to this thread, then I can tell you with near 100% certainty whether or not that message you got even came from Jagex. I've already had to help someone IRL not get had by a bad link. :geek:

 

BTW, if we could somehow rack up a repository of both good and bad messages, possibly in two separate threads, it would help the whole community. Just something to think over in your mind. :-k

 

~Mr. D. V. "out to stop the damn spammers/hackers..." Devnull

[MonkeyChee]

Monkeychee, If you could post a copy of the message source and headers in a quote to this thread, then I can tell you with near 100% certainty whether or not that message you got even came from Jagex. I've already had to help someone IRL not get had by a bad link. :geek:

 

BTW, if we could somehow rack up a repository of both good and bad messages, possibly in two separate threads, it would help the whole community. Just something to think over in your mind. :-k

 

~Mr. D. V. "out to stop the damn spammers/hackers..." Devnull

 

Thanks, is this all you need?

 

x-store-info:4r51+eLowCe79NzwdU2kR3P+ctWZsO+J

Authentication-Results: hotmail.com; sender-id=pass (sender IP is 65.125.54.126) [email protected]; dkim=neutral header.d=email.runescape.com; x-hmca=pass

X-Message-Status: n:0:n

X-SID-PRA: RuneScape <[email protected]>

X-SID-Result: Pass

X-AUTH-Result: PASS

X-Message-Delivery: Vj0xLjE7dXM9MDtsPTA7YT0xO0Q9MjtHRD0yO1NDTD00

X-Message-Info: 11chDOWqoTm2Ujy3iWQccKlyD9HHcixLf7izxW0hkuVSw3kEH5oiOQQkENKJ/Enbf5L2RIWA08kX6WrZwDLGtRe+bzaaECPuaaC8xxxiH8DTQ5YskujMLGGq6YWvrZxEFyHE2HR6ZnUX8xuxxwohlFCqzsewFKPh

Received: from ebm4.cheetahmail.com ([65.125.54.126]) by BAY0-MC4-F16.Bay0.hotmail.com with Microsoft SMTPSVC(6.0.3790.4900);

Tue, 22 Nov 2011 15:21:09 -0800

Content-Transfer-Encoding: 8bit

Content-Type: text/plain; charset=iso-8859-1

Date: Tue, 22 Nov 2011 23:21:09 -0000

From: "RuneScape" <[email protected]>

Message-Id: <[email protected]>

Received: (qmail 15881 invoked by uid 108); Tue, 22 Nov 2011 23:21:09 -0000

Reply-To: "RuneScape" <[email protected]>

Subject: Account Appeal was denied for your Jagex account

To: [email protected]

Return-Path: [email protected]

X-OriginalArrivalTime: 22 Nov 2011 23:21:09.0793 (UTC) FILETIME=[6AF5E110:01CCA96D]

 

Dear Player,

 

This is an automated email from RuneScape, sent because you submitted a Password Recovery request for this account.

 

Unfortunately, your password request has been denied.

 

Please click the following link and enter your username to view the reason why you appeal was denied:

https://[LikelyScam]/m=accountappeal/trackinginput.ws?code=P56797749-7AF9FFFC

 

Please read this information carefully if you intend to submit another appeal, as it will clarify the requirements to recover your password.

 

Kind regards,

The RuneScape Team

 

This is a service email, there is no need to unsubscribe. To ensure you always receive your RuneScape account emails to your inbox, please add [email protected] to your email address book.

 

© 2011 Jagex Ltd. Jagex® and RuneScape® are registered trademarks of Jagex Ltd in the United Kingdom and trademarks used in other countries of the world.

View our Privacy Policy : http://email.jagex.com/a/tBOr27AB8KDmdB8aUucNeezNA.B8KDmdDp/rs1.

This inbox is not monitored and you will not receive a reply to your email

 

Jagex Ltd. St. John's Innovation Centre, Cowley Road, Cambridge CB4 0WS United Kingdom.

 

[Sy_Accursed]

The one to keep an eye out for lately is theres a spate of .com.cm links

So at a glance u see services.runescape.com and think its right but its actually services.[ScamSite] which is not right.

[D. V. Devnull]

Monkeychee, If you could post a copy of the message source and headers in a quote to this thread, then I can tell you with near 100% certainty whether or not that message you got even came from Jagex. I've already had to help someone IRL not get had by a bad link. :geek:

 

BTW, if we could somehow rack up a repository of both good and bad messages, possibly in two separate threads, it would help the whole community. Just something to think over in your mind. :-k

 

~Mr. D. V. "out to stop the damn spammers/hackers..." Devnull

Thanks, is this all you need?

 

x-store-info:4r51+eLowCe79NzwdU2kR3P+ctWZsO+J

Authentication-Results: hotmail.com; sender-id=pass (sender IP is 65.125.54.126) [email protected]; dkim=neutral header.d=email.runescape.com; x-hmca=pass

X-Message-Status: n:0:n

X-SID-PRA: RuneScape <[email protected]>

X-SID-Result: Pass

X-AUTH-Result: PASS

X-Message-Delivery: Vj0xLjE7dXM9MDtsPTA7YT0xO0Q9MjtHRD0yO1NDTD00

X-Message-Info: 11chDOWqoTm2Ujy3iWQccKlyD9HHcixLf7izxW0hkuVSw3kEH5oiOQQkENKJ/Enbf5L2RIWA08kX6WrZwDLGtRe+bzaaECPuaaC8xxxiH8DTQ5YskujMLGGq6YWvrZxEFyHE2HR6ZnUX8xuxxwohlFCqzsewFKPh

Received: from ebm4.cheetahmail.com ([65.125.54.126]) by BAY0-MC4-F16.Bay0.hotmail.com with Microsoft SMTPSVC(6.0.3790.4900);

Tue, 22 Nov 2011 15:21:09 -0800

Content-Transfer-Encoding: 8bit

Content-Type: text/plain; charset=iso-8859-1

Date: Tue, 22 Nov 2011 23:21:09 -0000

From: "RuneScape" <[email protected]>

Message-Id: <[email protected]>

Received: (qmail 15881 invoked by uid 108); Tue, 22 Nov 2011 23:21:09 -0000

Reply-To: "RuneScape" <[email protected]>

Subject: Account Appeal was denied for your Jagex account

To: [email protected]

Return-Path: [email protected]

X-OriginalArrivalTime: 22 Nov 2011 23:21:09.0793 (UTC) FILETIME=[6AF5E110:01CCA96D]

 

Dear Player,

 

This is an automated email from RuneScape, sent because you submitted a Password Recovery request for this account.

 

Unfortunately, your password request has been denied.

 

Please click the following link and enter your username to view the reason why you appeal was denied:

https:///m=accountappeal/trackinginput.ws?code=P56797749-7AF9FFFC

 

Please read this information carefully if you intend to submit another appeal, as it will clarify the requirements to recover your password.

 

Kind regards,

The RuneScape Team

 

This is a service email, there is no need to unsubscribe. To ensure you always receive your RuneScape account emails to your inbox, please add [email protected] to your email address book.

 

© 2011 Jagex Ltd. Jagex® and RuneScape® are registered trademarks of Jagex Ltd in the United Kingdom and trademarks used in other countries of the world.

View our Privacy Policy : http://email.jagex.com/a/tBOr27AB8KDmdB8aUucNeezNA.B8KDmdDp/rs1.

This inbox is not monitored and you will not receive a reply to your email

 

Jagex Ltd. St. John's Innovation Centre, Cowley Road, Cambridge CB4 0WS United Kingdom.

Yes, MonkeyChee, this was all I needed to see, and I've just now taken a solid look over the source info. (BTW, sorry for the late reply! I had some major IRL issues hit during this last weekend.) It looks to me like the message is legit, which likely means that someone has made a failing attempt to hack your account out from under you. You can consider yourself safe for the most part, but I would suggest that you check with a few extra antivirus/antimalware scanners to make sure nothing got on your system. :geek:

 

~Mr. D. V. "It looks good to me... Finish double-checking your computer anyway." Devnull

 

 

 

 

[Multiple Edits by replying author due to the forum filter damaging their quote of MonkeyChee... If a Forum Mod could repair the damage, it would be appreciated, thanks!]

Edited November 28, 2011 by D_V_Devnull

[MonkeyChee]

 

Yes, MonkeyChee, this was all I needed to see, and I've just now taken a solid look over the source info. (BTW, sorry for the late reply! I had some major IRL issues hit during this last weekend.) It looks to me like the message is legit, which likely means that someone has made a failing attempt to hack your account out from under you. You can consider yourself safe for the most part, but I would suggest that you check with a few extra antivirus/antimalware scanners to make sure nothing got on your system. :geek:

 

~Mr. D. V. "It looks good to me... Finish double-checking your computer anyway." Devnull

 

 

 

 

[Multiple Edits by replying author due to the forum filter damaging their quote of MonkeyChee... If a Forum Mod could repair the damage, it would be appreciated, thanks!]

 

Hey, thanks for checking it. It does seem like that is what has happened, I've run scans on my computer and changed my passwords, so hopefully that should be the end of it now.