Phishing scam by email.

Jelly Fox

2009-01-20 03:05:24

I just got this and was kinda confused for a couple of reasons:
I have never received an email from Steam in the last 5 years
CS: Pro is a free mod
They will know I don't play CS
They know my name

So I googled, CS: pro and got their site, checked the forum, nothing about steam advertising them. checked my steam bookmark, it says it's http://store.steampowered.com/ so I delete the 'store' part and click go and it just changes back to 'store.steampowered.com' ...so already I'm thinking somethings up, I log into my steam client and look in my games...nothing! Then I hover over the link and look at the real address in my tool bar, it reads http://221.122.32.2O (that's the letter O and not a zero incase some retard clicks it)

So I trace that ip and badabing:

General Information

Hostname: 221.122.32.2O
ISP: CECT-CHINACOMM COMMUNICATIONS Co.,Ltd.
Organization: CECT-CHINACOMM COMMUNICATIONS Co.,Ltd.
Proxy: None detected
Type: Cable/DSL

Geo-Location Information

Country: China
State/Region: 22
City: Beijing
Latitude: 39.9289
Longitude: 116.3883
Area Code:

As far as I know Steam as based in the US, not China, so be careful.

Counter-Strike: Pro now available on Steam‏


From: [email protected] ([email protected])
High risk This message may be a phishing scam. Learn more
Sent: 19 January 2009 05:13:15
To: ****@hotmail.com

Dear Steam user,
This is an automated message generated by Steam account administration to inform its clients that the free 30-days-trial period of CounterStrike: Pro is now available.

To activate the trial please follow the following steps,

*Visit the Steam homepage http://www.steampowered.com/

.

*Log yourself in by using your Steam Username and Password.
(If you are in a public place, make sure you are the only one that sees your account information)

*After logging in you will get an activation code, copy the code and move on to the next step.
You will now have to choose between ATI & nVIDIA.

*After clicking on the ATI or nVIDIA logo, you will be asked for the activation code
(So make sure you have copied the code)

After following all these steps, your game is now activated on your Steam account.
You can now go to the 'Games' tab on Steam and download your free CounterStrike: Pro 30-days-trial.

Signed,

The Steam Team
To contact us, email [email protected]

==============
This notification has been sent to the e-mail address you provided when you created your Steam account. For information on Valve's privacy policy,
please visit http://www.valvesoftware.com/privacy.htm
This is the FAKE Steam page:

Image

This is the REAL Steam Page:

Image

The only difference is the URL and the numbers of players... it's actually very well made, it even links back to the REAL site :shock:

keefy

2009-01-20 05:42:31

Anything available on steam is on steam, no need to enter passwords into anything except when logging in to steam itself.
Do we have to be pro to play?

phantom

2009-01-20 21:55:38

steam doesnt give "30-day free trials" from what i know its either a demo or the game.

dbanimal

2009-01-20 23:05:57

I wouldn't do it, don't like CS anyway.

Jelly Fox

2009-01-20 23:10:56

phantom wrote:steam doesnt give "30-day free trials" from what i know its either a demo or the game.
it's a scam. the ip address has been reported for phishing.

knew it was dodgy!

Jelly Fox

2009-01-20 23:49:18

Image

keefy

2009-01-21 01:05:05

All they did was to copy the steam page, its easy
right click save page as.
http://keefy.co.cc/
:shock: :lol: :mrgreen:

Jelly Fox

2009-01-21 01:09:05

OH...that's frickin sweet :shock:

Ziah

2009-01-31 17:41:32

I thought it looked a bit dodgy. The email was pretty well crafted though.

Jelly Fox

2009-02-01 05:37:52

Totally, I bet it tricked a lot of little CSS kiddies out of an account.

What I want to know is how they managed to send it from [email protected] OR how they spoofed that address... mmm!

s0iz

2009-02-01 22:06:34

n1 with that IP tracing!

Code: Select all

www.steamcommunity.com.ar
Same here:
Entidad Registrante:

Juan Portugal
País:

Argentina
Actividad:

Otra

Datos en Argentina

Domicilio:

espejo 232 3 0
Ciudad/Localidad:

mendoza
Provincia:

Mendoza
Código Postal:

5500
Teléfono:

4251860
Fax:

4251860
Persona Responsable:

Juan Portugal
Domicilio:

espejo 232 3 0
Ciudad:

mendoza
Código Postal:

5500
Provincia:

Mendoza
País:

Argentina
Teléfono:

4251860
Fax:

4251860
Horario de contacto:

permanentemente
Entidad Administradora:

Live Interactive SRL
Domicilio:

-- -- -- -- -- -- --
Ciudad:

--
Código Postal:

--
Provincia:

Buenos Aires
País:

Uruguay
Teléfono:

--
Fax:

--
Actividad:

Proveedor de Servicios de Internet
Contacto Técnico:

Martin Caetano Huertas
Domicilio:

Miguel Angel Chiappe 1258
Ciudad:

Montevideo
Código Postal:

12400
Provincia:

País:

Uruguay
Teléfono:

00598 2 3553844
Fax:

00598 2 3553844
Horario de contacto:

08 - 20
Servidores DNS:


DNS Primario:

Nombre:ns1.gratishost.com
Dirección IP:
DNS Secundario:

Nombre:ns3.gratishost.com
Dirección IP:
Datos opcionales:


Servidor alternativo:
Servidor alternativo:
Servidor alternativo: