Botting Notice Email? HAHA?

[Kiwi Karma]

Looks like it's some fanboy trying to scare you. Doesn't look like there's any phishing going on but definitely some email address spoofing.

 

[Tiemen]

Hmmm, did you guys receive these on sythe emails etc or on actual emails that are linked to rs accounts?

I have no accs linked to my MSN but didnt get a mail either :S

Mail received but no account linked, anyone?

 

[Dazzler]

Hmmm, did you guys receive these on sythe emails etc or on actual emails that are linked to rs accounts?

I have no accs linked to my MSN but didnt get a mail either :S

Mail received but no account linked, anyone?

Couldn't say, both are linked to same email.

I'm going to post the complete header information of a legit jagex email and this one, maybe someone on here is more knowledgable. I did remove a chunk from each of the long string of letters that probably don't mean anything just to make it more friendly on the eyes.



Legit Jagex Email Header

From RuneScape Wed Sep 21 16:19:55 2011
X-Apparently-To: xxxxxxxxx via xxxxxxxx; Wed, 21 Sep 2011 09:19:34 -0700
Return-Path: <[email protected]>
Received-SPF: pass (domain of b.email.runescape.com designates 63.236.76.19 as permitted sender)
X-Originating-IP: [63.236.76.19]
Authentication-Results: mta1084.mail.ac4.yahoo.com from=email.runescape.com; domainkeys=neutral (no sig); from=email.runescape.com; dkim=neutral (no sig)
Received: from 127.0.0.1 (HELO mta823.chtah.net) (63.236.76.19)
by mta1084.mail.ac4.yahoo.com with SMTP; Wed, 21 Sep 2011 09:19:33 -0700
Date: Wed, 21 Sep 2011 16:19:55 -0000
Message-ID: <bwcwhrqbfph10gau7k6j7qgmjf8g0s.14566918425.4153@mta823.email.runescape.com>
List-Unsubscribe: <mailto:[email protected]>
From: "RuneScape" <[email protected]>
To: xxxxxxxxxxxxx
Subject: Exclusive New In-Game Items!
MIME-Version: 1.0
Reply-To: "RuneScape" <[email protected]>
Content-type: multipart/alternative; boundary="=bwcwhrqbfph10gau7k6j7qgmjf8g0s"
Content-Length: 7619

The full header of the email in question

From RuneScape Tue Oct 25 18:32:17 2011
X-Apparently-To: xxxxxxxxxxxxxxx via xxxxxxxxxxx; Tue, 25 Oct 2011 11:31:55 -0700
Return-Path: <[email protected]>
Received-SPF: pass (domain of b.email.runescape.com designates 63.236.76.20 as permitted sender)
X-Originating-IP: [63.236.76.20]
Authentication-Results: mta1057.mail.ac4.yahoo.com from=email.runescape.com; domainkeys=neutral (no sig); from=email.runescape.com; dkim=pass (ok)
Received: from 127.0.0.1 (HELO mta824.chtah.net) (63.236.76.20)
by mta1057.mail.ac4.yahoo.com with SMTP; Tue, 25 Oct 2011 11:31:55 -0700
DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; d=email.runescape.com;
s=20111006; t=1319567537; x=1335378737;
bh=HqRvVYBRy9PQ1cH7u3f/bfiDeQQ=; h=From:Reply-To;
b=zMy1KP2GGhOKK8HqAA7PESg1rJ1AAh7hqeDV9tLE8yooxb8NBw1XQ1qESKbgjgSmi
hzZaizhRAu96p3kigU7mNhW03fSS4DY5iRY5wOh4NtYzGgkw+Np2VcGEcn/WGYWIo4
AAHulf0/N9qOd0ze5CHuuqP/pliNvhZ5gkg4J24s=
Date: Tue, 25 Oct 2011 18:32:17 -0000
Message-ID: <bwtjfz7bfph10gau7ye6vqgmjf8gpb.14566918425.1256@mta824.email.runescape.com>
List-Unsubscribe: <mailto:[email protected]>
From: "RuneScape" <[email protected]>
To: xxxxxxxxxxxxxxxxxx
Subject: IMPORTANT: RuneScape Bot Notice, Please Read.
MIME-Version: 1.0
Reply-To: "RuneScape" <[email protected]>
Content-type: multipart/alternative; boundary="=bwtjfz7bfph10gau7ye6vqgmjf8gpb"
Content-Length: 9085

In the email above I bolded the main difference I noticed that isn't in the other legit email from jagex, not sure if it means anything.

I'm not sure if it's possible to completely spoof all of that, but if it is possible then case closed it's fake.

 

[Deuce]

Jagex doesn't send emails to players except regarding account recovery. Weird it doesn't have a link though.

 

[Insane Gods]

X-Originating-IP: [63.236.76.19]

X-Originating-IP: [63.236.76.20]

Those 2 IPs are very similar, it may be real.

 

[FullTilt]

It's obviously legit as it is hosted on their website:
http://ebm.email.runescape.com/c/tag/hBOpwApB8L3HHB8eKRzNXBfQxMV/doc.html?t_params=

 

[Insane Gods]

It's obviously legit as it is hosted on their website:
http://ebm.email.runescape.com/c/tag/hBOpwApB8L3HHB8eKRzNXBfQxMV/doc.html?t_params=

Nice find, but I'm sure they'll fail once again in trying to sue people for using "iBot."

 

[Ordou]

It's obviously legit as it is hosted on their website:
http://ebm.email.runescape.com/c/tag/hBOpwApB8L3HHB8eKRzNXBfQxMV/doc.html?t_params=

why is there a ebm in front of it, I've been temp banned from botting and haven't received this either

 

[Emperor Nero]

I am going to be honest and say that I have never even heard of iBot. What is it? Do people actually use it?

 

[Jimmy]

why is there a ebm in front of it

It's a subdomain; it doesn't really matter. The fact is that this is an actual Jagex email that's being mass-sent to supposed botters.

 

[FullTilt]

I am going to be honest and say that I have never even heard of iBot. What is it? Do people actually use it?

iBot is a Nexus product, however instead of running 1 script ala an auth code, it is a more 'normal' bot client, similar to RSBuddy or Powerbot. You are given a script selector to choose your scripts based on subscriptions you have made through iCredits.

 

[Jimmy]

I am going to be honest and say that I have never even heard of iBot. What is it? Do people actually use it?

It's ruler's bot, also known as neXus. It's bound with auths and resold as rsbots, all of the Perfecticus bots, etc., etc.

 

[puzzle567]

I feel like this e-mail is to save them time on banning the younger group of botters that find this intimidating.

 

[Insane Gods]

I've found a similar lawsuit of them trying to do almost the same thing I believe.


http://www.rfcexpress.com/lawsuits/...court/51797/jagex-limited-v-john-doe/summary/

 

[Sanctuary]

I'm confused as to whether or not this is a legitimate email. Regardless, I've yet to receive one! Woot.

 

[Bmadis0n]

Go to the official forums... there is a sticky confirming they are sending these out.

 

[nosaM eerF]

Glad to see i havent recieved one on any email, not going to be botting amyore though!

 

[ttrync]

CONFIRMED FROM JAGEX QFC: 15-16-719-63310840 http://services.runescape.com/m=forum/c=OiYI3MGeLnA/forums.ws?15,16,719,63310840,goto,3

Page 3

 

[gffr00b]

This is legit

http://services.runescape.com/m=forum/forums.ws?14,15,831,63310676

 

[sonic_fanrs]

Jagex is full of shit.

Their legal department doesn't know anything.