Fake emails saying I'm selling my online accounts? WTF?!?!

[Sketcz]

Wasn't sure where to put this but here.

I have now had 3 (THREE!) emails saying that I'm trying to sell the following online accounts of mine:
Runescape
DOFUS
World of Warcraft

The thing, I DO NOT have accounts for any of these!

Furthermore, this email account is my super strong one, reserved only for close family and friends, and there is no way anyone could have discovered it. Then again, it's also what I use for eBay, and recently there was a fiasco with a Croatian crooking me out of money, and he probably has this email as a result of our deals.

How did this super secret private email of mine get out? It's been spam free for 13 years!

Anyway, has anyone else been getting these? Is it going around?

I realise it's some kind of scam, but what I want to know is this...

1) Is it a case of spammers getting the email and sending junk mail?
2) Someone getting the email and opening online accounts with it?

Here's the Warcraft email:

From: [email protected] ([email protected])
Sent: 17 July 2011 18:32:41
Microsoft SmartScreen marked this message as junk and we'll delete it after ten days.
Wait, it's safe! | I'm not sure, show content

Greetings,

It has come to our attention that you are trying to sell your personal World of Warcraft account(s). As you may not be aware of, this conflicts with the EULA and Terms of Agreement. If this proves to be true, your account can and will be disabled. It will be ongoing for further investigation by Blizzard Entertainment's employees. If you wish to not get your account suspended you should immediately verify your account ownership.

You can confirm that you are the original owner of the account to this secure website with:

http://www.battle.net/login/en-gb/login.html?ref=https%3A%2F%2management%2F&eor=0&app=bam&cr=true

Login to your account, In accordance following template to verify your account.

* Account name
* Account password
* First and Surname
* Secret Question and Answer
Show * Please enter the correct information

If you ignore this mail your account can and will be closed permanently.

Once we verify your account, we will reply to your e-mail informing you that we have dropped the investigation.

Regards,

Account Administration Team
Blizzard Entertainment

http://www.blizzard.com/support/

World of Warcraft , Blizzard Entertainment 2010

Please retain all history if you reply to this mail

[briareos_kerensky]

Never got one like this but yesterday I got my first Google + spam mail, and of course no G+ account. Getting hold of a mail address can be done in multiple ways, from randomly generating addresses or, more likely, your address was indexed by some search engine and "made public" to spam bots.

[Flabio]

Ay, every email address ends up on a spam list eventually. Can just be a friend you email having a virus that collects email addresses...

[Sketcz]

Ay, every email address ends up on a spam list eventually. Can just be a friend you email having a virus that collects email addresses...

Really? Well, it was a good 13 year run.

Now that you mentioned it, I did have an email from a friend's account which appeared the victim of a virus - guess it could be that.

[chopemon]

I get Warcraft spam all the time. Very annoying.

[charlesr]

Have you googled your email address?

[mekanor]

On the topic of spam, my hotmail address gets hundreds of spam emails these days and I've no idea why. They all get filtered to junk straight away of course, but it's strange that I get so many.

[Sketcz]

Have you googled your email address?

Regularly, def not on there.

[Flabio]

I get loads on my work email, and that only ever gets used for internal email...

[abigsmurf]

Also, blame poorly designed login screens.

If a login gives a different error when you choose a non-existant email address to one where you choose an incorrect password. It's only a botnet away from harvesting all the login names. Especially if it's a generic domain name.

[Sketcz]

Ooh, that's clever thinking abigsmurf... I hadn't considered such a devious method for sucking up addresses.

[abigsmurf]

Ah the fun of being a web developer and how incredibly difficult it is to write code that can't be hacked or abused.

Still, at least the days of writing such horrors as "include $_GET['id'];" are long behind me.