Has my Battle.Net account been hacked?

Got this email just now. I checked Battle.net and theirs no notice of a character faction transfer on my account. I only ask this because I have had my account hijacked before.

WoWAccountEU@review.blizzard.com
to me

show details 4:08 AM (14 hours ago)


Hello,

A Character Faction Change is now pending for the World of Warcraft account DELETED. Please allow several days for the faction change process to complete. An email will be sent to you when it is done. You can also track the status of your request by signing into the Transaction page here: http://us.worldofwarcraft.characterv...ge-status.html.

Below is a summary of the transaction, which you may want to keep for your records.

------------------------------------------------------------------------------------------------------------------------------------------------

World of Warcraft Account Name: DELETED
TRANSACTION ID: 18055176

------------------------------------------------------------------------------------------------------------------------------------------------

Please note the following additional information:

- This account is not available for play while the faction change is pending.
- If you did not make this transaction, you should immediately check your account to prevent character lost.
- This account cannot change factions again until 3 days have elapsed.
- You can review this and other Account Management transactions by logging into Account Management and going to your Transactions page at https://us.worldofwarcraft.character...ge-status.html.
- For more details on Character Faction Change, refer to the Character Faction Change FAQ located at http://us.blizzard.com/support/artic...ategoryId=2327.

You can find World of Warcraft Account Management at: http://us.worldofwarcraft.worldofwar...com/login.html

We hope you enjoy your new faction!

Regards,

The World of Warcraft Team
Blizzard Entertainment

[snowmanwithahat]

Probably...

I was hacked once and the same thing happened, sold all my ****, moved my characters.

You might want to armory one of your characters, see if they're naked. Remember BOA gear doesn't sell.... so that won't be missing, or arena gear, or tier gear

[Ninja Prime]

WoW Scammers are getting really smart, unfortunetly. They copy real blizzard E-mails, sometimes with real blizzard links in them, but with bad links or redirects. Have to be really careful, personally I dont click any link in any mail from anything that looks like blizzard, I go to my account through normal methods if the notice isnt an obvious scam. Confirm its not through normal methods, then report them as a phishing scam IMO. Never been hacked myself, but several people in my guild have, irritating to have to wait to get the guild bank back, especially after the 4th or 5th time. Also, get an authenticator, its like $7 and its 99.9999% effective.

[Q]

Post the headers of that email.

Characterverify DOT com.

lulz

Delivered-To:
Received: by 10.220.163.17 with SMTP id y17cs39599vcx;
Wed, 28 Jul 2010 15:09:11 -0700 (PDT)
Received: by 10.213.39.196 with SMTP id h4mr996586ebe.42.1280354950482;
Wed, 28 Jul 2010 15:09:10 -0700 (PDT)
Return-Path: <xmiranndax@hotmail.com>
Received: from blu0-omc4-s29.blu0.hotmail.com (blu0-omc4-s29.blu0.hotmail.com [65.55.111.168])
by mx.google.com with ESMTP id v59si160012eeh.75.2010.07.28.15.09.09;
Wed, 28 Jul 2010 15:09:10 -0700 (PDT)
Received-SPF: pass (google.com: domain of xmiranndax@hotmail.com designates 65.55.111.168 as permitted sender) client-ip=65.55.111.168;
Authentication-Results: mx.google.com; spf=pass (google.com: domain of xmiranndax@hotmail.com designates 65.55.111.168 as permitted sender) smtp.mail=xmiranndax@hotmail.com
Received: from BLU0-SMTP28 ([65.55.111.136]) by blu0-omc4-s29.blu0.hotmail.com with Microsoft SMTPSVC(6.0.3790.4675);
Wed, 28 Jul 2010 15:08:45 -0700
X-Originating-IP: [222.69.163.232]
X-Originating-Email: [xmiranndax@hotmail.com]
Message-ID: <BLU0-SMTP2891D5B794934FFB507199DDA80@phx.gbl>
Return-Path: xmiranndax@hotmail.com
Received: from wo ([222.69.163.232]) by BLU0-SMTP28.blu0.hotmail.com over TLS secured channel with Microsoft SMTPSVC(6.0.3790.4675);
Wed, 28 Jul 2010 15:08:44 -0700
Reply-To: <WoWAccountEU@review.blizzard.com>
From: "WoWAccountEU@review.blizzard.com" <WoWAccountEU@review.blizzard.com>
To: <>
Subject: World of Warcraft -- Character Faction Change Notice
Date: Wed, 28 Jul 2010 17:08:11 +0800

Here ya go, Now I see the hotmail address.

[Redeemed]

Originally Posted by |MaguS|

Here ya go, Now I see the hotmail address.

Whoa. So that means those where fake links that would just send your info to their e-mail?

Now that you have their e-mail I'd send them a crap load of spam. Sign them up for everything you can imagine. That oughta' piss 'em off.

[Q]

I would pull your email address out of that header info, or this will just be the beginning of your phishing woes.

That's some decent social engineering, though, and the mix of legit and non-legit links was nice. The fact you were a victim of hacking before, and that they copied a legit email.... not bad at all.

Glad you didn't get scammed.

Originally Posted by Q

I would pull your email address out of that header info, or this will just be the beginning of your phishing woes.

That's some decent social engineering, though, and the mix of legit and non-legit links was nice. The fact you were a victim of hacking before, and that they copied a legit email.... not bad at all.

Glad you didn't get scammed.

Done, Not like that email is very private. Just wondering how they knew I had a WoW account. Haven't played WoW in almost 2 years.

[Mr. Hunt]

Can't believe you fell for that, Magus. Thought you were a little smarter. My WoW account got hacked also. Problem is, I don't have a WoW account :\.

[Redeemed]

Originally Posted by |MaguS|

Done, Not like that email is very private. Just wondering how they knew I had a WoW account. Haven't played WoW in almost 2 years.

They probably figured this would go under the radar, maybe.

I'd still sign them up for every possible site you could think of, and every possible newsletter and advertisement. Make 'em regret what they did.

Sign them up for beasty and kiddie porn, then report them to Blizzard and the police.

[ViN86]

LOL I went to click on that link in the OP and OpenDNS automatically flagged it as a Phishing site.

EDIT: Originating IP is China. Someone run a port scan, see what they're up to. lol