Virtual World Phishing

Though many MMORPGs have "fishing" as a profession, I recently received the first phishing email related to VWs. Yes, it seems that your game account may be as valuable and vulnerable as your bank account.

The full message is provided under the fold, along with some commentary about it.

From: Eve Team "suspension@eve-online.com"

Date: September 3, 2005 10:20:26 PM EDT

To: hunterd@wharton.upenn.edu

Subject: Limited Account Access - Eve-online

We are contacting you because on 2 Sep 2005 our Account Review Team
identified some unusual activity in your account. In accordance
with Eve's User Agreement and to ensure that your account has not
been compromised, access to your account was limited. Your account
access will remain limited until this issue has been resolved.

To secure your account and quickly restore full access, we require
you to login in you account .This process is mandatory, and if not
completed within the nearest time your account may be subject for
suspension or will be banned

To securely confirm your Eve-Online information please click on the
link bellow:

[Redacted to avoid mistaken logins]

We encourage you to log in and perform the steps necessary to
restore your account access as soon as possible. Allowing your
account access to remain limited for an extended period of time may
result in further limitations on the use of your account and
possible account closure.

Thank you for using Eve-online!
The Eve Team

As you can see, the href for the link actually takes you to "http://www.portatildirecto.com" a domain that the whois record indicates is owned by "Juan de Diego" of Madrid. Of course whois records are notoriously flaky, so it's anyone's guess who is running this scam.

The mechanics of the phishing attempt are no more sophsticated than usual, but I'm struck by the fact that the scammers are now phishing for login details for virtual worlds. Presumably they empty the account as soon as they get the password, by transferring the assets to their accounts, and then they sell the virtual assets on eBay. It's an indication of how significant the asset holdings are in some of these worlds, that it's worth setting up a scam like this for the account details. And it can hardly be an accident that the first one targets EVE--a world known mostly for its trade.

Expect more attempts in other MMORPGs in time.