Thread: LOTRO Spoofing Message In-Game

Recently, In-Game Support has seen a rise of in-game messages telling players they need to visit a website to contest a warning. This is a spoofing message and players should not follow the link. These messages do not come from Turbine employees. The message says " Becasuse you suspected of lllegal trade for gold, system will freeze your ID after one hour.If you have any questions, please login (url) to make a complaint .We will be processing as soon as possible.Thank you for your understanding!" This is incorrect.


Remember, a Turbine employee will always:

• Have a + symbol in front of their name
• Refer you to one of our official websites, myaccount.turbine.com or lotro.com
• Always answer questions or concerns you have about the issue.

If you have any concerns of think this was a spoofing message, you may right-click the message, go to Chat, then Report as Gold Spam. Our In-Game Support team will then investigate the issue.

Remember, do not visit the website and put in your account name and password, as it will compromise your account.

Again they're trying this one? I mean, even down to the same misspelled message? Sheesh.

Add to the list:
Turbine employees know how to use verbs.

One other thing to remember. When a GM contacts you, not only is there a + in front of the name, but the IM appears in every chat tab, even if you have IMs disabled for it. There is no way for another player to pull that off.

Thanks for the alert. I cannot believe this is still going on.

This also goes for emails about your WoW, Lineage2 and all other MMORPG accounts. The email sender will appear to be official, but the links in the mail certainly won't.

we were laughing abot the message last night in a turtle raid i wan. 4 people all got the same message withoun about 2 mins of each other all from diffrent people. just looking at the adress they tell u to go to should be enough to tell u its fake(its a 3rd party adress ) and then it wasnt coming from a + name though i believe it was a *named

I don't know which is worse....

That they try this **** over and over again, bad spelling and easily laughable attempt to steal account info.

or

That there are actually people who fall for this.

I received a similiar message in my email regarding me "attempting to sell" my WoW account.

Very Lame. These people just have too much time on their hands ripping off others. Just lame!

I got sent one of these messages a few months ago. Right-Clicked and Inspected the sender and it was a level 7 Hobbit Burglar in Michel Delving.

Not sure if I should feel insulted more that the person couldn't spell or that they though I was stupid enough to fall for it. Either way, Right-clicked and Reported them.

Sad to see them trying the same old Scam again.


And as far as the Emails from the "wowaccountadmin", I get about 5 of those a week, and I haven't played the game in over 4 years...

Just a hint, if you get one of these emails, hover over the link they imbed and you will see some interesting misspelled versions of "www(dot)worldofwarcraft(dot)c om."



As for the ingame messages, this most likely means that someone has fallen for it.

They get your account info, log every character you have on and sell everything. Mail the money to another character. Make an Alt and send tells to everyone on your Friends list, or even people that are level 60 and up.

If someone responds to the link, the process starts all over. They are not worried about items anymore. It's the ingame gold they want. By any means necessary.

Just like the GM's have said, always look for the +Name. If they don't have it, report and Ignore them.


I remain,

I think most of us can pick out right away that this is completely bogus due to the terrible spelling and grammar, but there is a sizable number of players here who are not native English speakers. At the very least, Spanish and French are also official languages in North American countries, and I often see both of these languages being used in the game. I'm sure the players here represent hundreds of different native languages.

I'm sure many of these players could have some trouble recognizing the grammar problems in that message and would be more likely to be fooled by it. It has nothing to do with being stupid or gullible or uneducated. Hopefully the warnings will help prevent people in our community of LotRO players from being scammed.

Originally Posted by Sonsy

I think most of us can pick out right away that this is completely bogus due to the terrible spelling and grammar, but there is a sizable number of players here who are not native English speakers. At the very least, Spanish and French are also official languages in North American countries, and I often see both of these languages being used in the game. I'm sure the players here represent hundreds of different native languages.

I'm sure many of these players could have some trouble recognizing the grammar problems in that message and would be more likely to be fooled by it. It has nothing to do with being stupid or gullible or uneducated. Hopefully the warnings will help prevent people in our community of LotRO players from being scammed.

I have to agree with this, I know of someone who was scammed (not in game, different kind of scam) and when they showed me the e-mail I read it once and said bad English it is a scam, and they looked at me and said what is wrong with the English?

They had good English, however it was still thier second language and they missed the grammatical error and the fact that it read as if it was written by someone whose first language was not English.

That is how the spoofing message above reads to me as well, something written by someone whose first language is not English.

Originally Posted by Penter-Kar

One other thing to remember. When a GM contacts you, not only is there a + in front of the name, but the IM appears in every chat tab, even if you have IMs disabled for it. There is no way for another player to pull that off.

In addition, you usually get a prompt (with a sound if you have sounds on) that says "Admin communication in chat log".

Thanks to the message board post it saved me from this spoof I was quiet taken by it when I got hit with it since my toon is broke most of the time but still confused. so thanks for the post it saved me!

Originally Posted by Nod

Recently, In-Game Support has seen a rise of in-game messages telling players they need to visit a website to contest a warning. This is a spoofing message and players should not follow the link. These messages do not come from Turbine employees. The message says " Becasuse you suspected of lllegal trade for gold, system will freeze your ID after one hour.If you have any questions, please login (url) to make a complaint .We will be processing as soon as possible.Thank you for your understanding!" This is incorrect.


Remember, a Turbine employee will always:

• Have a + symbol in front of their name
• Refer you to one of our official websites, myaccount.turbine.com or lotro.com
• Always answer questions or concerns you have about the issue.

If you have any concerns of think this was a spoofing message, you may right-click the message, go to Chat, then Report as Gold Spam. Our In-Game Support team will then investigate the issue.

Remember, do not visit the website and put in your account name and password, as it will compromise your account.

Originally Posted by Cerridwen

In addition, you usually get a prompt (with a sound if you have sounds on) that says "Admin communication in chat log".

That doesn't happen every time you're messaged by a GM, I've had some cases with GM's where that message didn't appear at all.

However I haven't had any recent GM issues since the latest updates so the may of made that a mandatory message.

Originally Posted by Nod

Recently, In-Game Support has seen a rise of in-game messages telling players they need to visit a website to contest a warning. This is a spoofing message and players should not follow the link. These messages do not come from Turbine employees. The message says " Becasuse you suspected of lllegal trade for gold, system will freeze your ID after one hour.If you have any questions, please login (url) to make a complaint .We will be processing as soon as possible.Thank you for your understanding!" This is incorrect.


Remember, a Turbine employee will always:

• Have a + symbol in front of their name
• Refer you to one of our official websites, myaccount.turbine.com or lotro.com
• Always answer questions or concerns you have about the issue.

If you have any concerns of think this was a spoofing message, you may right-click the message, go to Chat, then Report as Gold Spam. Our In-Game Support team will then investigate the issue.

Remember, do not visit the website and put in your account name and password, as it will compromise your account.

You know, Nod, if your company would deny IP's west of Hawaii and north of Australia access to the American continents servers, you'll probably see less of this. Just saying.

Sheesh... can't believe scammers sometimes... sorry to anyone who cannot recognize this is a scam (due to not reading English as well as other's for whatever reason). Hopefully the scammers will be banned promptly.

Originally Posted by Dalthalion

You know, Nod, if your company would deny IP's west of Hawaii and north of Australia access to the American continents servers, you'll probably see less of this. Just saying.

Yea, good idea, deny random IP pools in Asian territories when almost 60% of them use either regionally-specific IP pools or spoofs...

You've tallied them yourself, then? I doubt it.

It's just very obvious where the trouble is coming from, and, even though they are able to bounce around worldwide IP's, why make it easy for them? Cutting off the point of origin first is a good start, I feel.

Originally Posted by Dalthalion

You've tallied them yourself, then? I doubt it.

It's just very obvious where the trouble is coming from, and, even though they are able to bounce around worldwide IP's, why make it easy for them? Cutting off the point of origin first is a good start, I feel.

Except that almost all of them have circumvented this by spoofing, therefor denying various IP pools in the offending countries would be pointless and have a higher probability of losing revenue from legitimate customers.

Ah, but where is the majority of the American continent servers' player base? I'm willing to bet they are...living in the Americas.

However, with the charlatans from Asia being much less plentiful on servers in the Americas, one can only conclude that they are more of a drain on Turbine's rsources and legitimate players' patience than a boon, wouldn't you say? Cutting off Asia may very well be an acceptable loss. If, after all, a giant like Google is willing to consider cutting off China, why couldn't Turbine?

Originally Posted by Dalthalion

Ah, but where is the majority of the American continent servers' player base? I'm willing to bet they are...living in the Americas.

However, with the charlatans from Asia being much less plentiful on servers in the Americas, one can only conclude that they are more of a drain on Turbine's rsources and legitimate players' patience than a boon, wouldn't you say? Cutting off Asia may very well be an acceptable loss. If, after all, a giant like Google is willing to consider cutting off China, why couldn't Turbine?

And those who are in the military and/or just abroad have to suck it up, right?

With deep respect to them, for me that is an entirely different topic.

Originally Posted by Fehlsharpeye

Add to the list:
Turbine employees know how to use verbs.

LOL


*this msg too short for filter*

Just a bit Off-Topic.

I recently received a "fake" email from NCSoft telling me that my Aion account was being investigated for possible fraudulent usage.

Here's the interesting thing.

I don't have an Aion Account. I've never even played the game....



And I still get the "fake" wowaccountadmin emails at least twice a week.


The good news is that I have not recieved one from a "fake" LOTRO admin. I guess we are not as important as the bigger fish.


I remain,

I have gotten a bunch of e-mails concerning my WoW account, which I do have. The e-mail looks almost official except for two things, when I did an actual change to my account the real e-mail that does get sent out has your actual account name in it, on the fake one it doesn't. The e-mail it is sent from looks real except look at the mailed by spot. The fake ones have been coming thru hotmail

Originally Posted by Dalthalion

You know, Nod, if your company would deny IP's west of Hawaii and north of Australia access to the American continents servers, you'll probably see less of this. Just saying.

Someone has never heard the phrase "cutting off one's nose to spite one's face".

Why would any business willingly cut off revenue in this fashion? Because of a handful of criminals? Please, get a clue.

Originally Posted by Dalthalion

If, after all, a giant like Google is willing to consider cutting off China, why couldn't Turbine?

It's posturing and PR, they haven't left and have no intention of doing so.

Originally Posted by Dalthalion

You know, Nod, if your company would deny IP's west of Hawaii and north of Australia access to the American continents servers, you'll probably see less of this. Just saying.

You really have no idea about how RMT works, do you? Nor, I suspect, do you understand the concept of a proxy server.

Just saying.

Originally Posted by Emrys_Redweaver

Someone has never heard the phrase "cutting off one's nose to spite one's face".

Why would any business willingly cut off revenue in this fashion? Because of a handful of criminals? Please, get a clue.

I look forward to your better solution.

In the meantime, Turbine doesn't have to lose revenue in those area. They just need to have an insulated server (or set of servers) that covers the Asian continent and its surrounding islands. With many of the malcontents originating there, they would be free to tick off their own countrymen and immediate neighbours.

Originally Posted by Kraggy

You really have no idea about how RMT works, do you? Nor, I suspect, do you understand the concept of a proxy server.

Just saying.

You exaggerate my naivete. I know full well that they have workarounds, so I gave a solution that addressed direct connections.

I'll be frank. Any attempt by Turbine to pursue any sort of legal action against the companies in China that run these illicit rings is going to come to naught, because the Chinese government couldn't give a rat's patootie about what an American software developer's grievances are. So, the first part of a solution is to cut them completely off from direct contact. If the criminals decide to use workarounds, through places more within the realm of jurisprudence, then those can be picked off systematically.

Now, I certainly have not had experience in the use of proxy servers and the like, but I know that, when you have a large leak, you seal what's visible and then look for signs of what gets around that stopgap.

Originally Posted by Dalthalion

You exaggerate my naivete. I know full well that they have workarounds, so I gave a solution that addressed direct connections.

I'll be frank. Any attempt by Turbine to pursue any sort of legal action against the companies in China that run these illicit rings is going to come to naught, because the Chinese government couldn't give a rat's patootie about what an American software developer's grievances are. So, the first part of a solution is to cut them completely off from direct contact. If the criminals decide to use workarounds, through places more within the realm of jurisprudence, then those can be picked off systematically.

Now, I certainly have not had experience in the use of proxy servers and the like, but I know that, when you have a large leak, you seal what's visible and then look for signs of what gets around that stopgap.

There is one small problem with your methodology...


Using the analogy of it being a leak, let's say that Turbine does intend on blocking access from those countries that are known to partake in the gold farming/spamming/sales...

Now, taking the analogy and putting a real-world feel to it...let's say Turbine is a dam, dams have areas to which water is allowed to pass through and where it is not...

Where water is passed through can be likened to where Turbine freely gives access to areas (say NA subscribers) and that where water is not capable of passing through is where Turbine would be blocking access (your hypothetical Asian markets)...

Now, what would happen if the reports that the operators of the dam state that all water was passing through correct areas at the right times? This is effectively what a proxy, IP spoof, or other well-known and easily obtainable means to camouflage originating IPs are doing.

Say Dim Sum in China is using an IP spoofer to play WoW on the NA servers, he loads up his spoofer and plugs in a valid IP pool from an area to which WoW would allow access from. For all intents and purposes the server handshake believes that it's coming from a region that is allowed and not one in China.

In other words, blocking an entire region is going to do absolutely nothing to remove these issues and will only open the door to more issues in related to those who would rightly want access to the servers.

And this doesn't even touch on the subject of my previous example of military and traveling subscribers who are connecting while overseas.

Oh no, the gold farmers have found their way to LOTRO! This is why if you're gonna go F2P, don't give complete access to high-gold areas! We have a new battle on our hands; a battle against the stupid farmers. Battleplan: if you see one, gank and grief them til they leave or die. Ugh. And I thought Sauron was evil...