World Of Warcraft site redirects to your site

[dimisdas]

Hello everyone.

I am just creating this thread to leave "leechers" status.

I noticed today that this page:
hXXP://w w w . wow-europe.com/login/login?service=PXXPP://w w w . wow-europe.com%2Faccount%2F

checks your Account details (pass and username) , saves them in a cookie and affter it is done it redirects you to PXXPP://w w w . wow-europe.com%2Faccount%2F page.

-So what?
-You can create a account scam page which will be like the WoW login one but it will say that the password is wrong. In a scam email you add a link like:
PXXP://w w w . wow-europe.com/login/login?service=PXXPP://YOUR SCAM WEBSITE . !!!

So he enters his password again and bingo!

-Why should i follow this way?
-Because many people in scam emails check links. That way the victim will see wow-europe.com/worldofwarft.com domain so he will think it is safe.

-Dimis


SCREENSHOTS:

[TheGreatRowaH]

Can't get it to work, when I do

https://www.wow-europe.com/login/log.../www.yahoo.com

it simply goes to the wow-europe log-in page.

Nice idea, and if it works you'll be getting boatloads of rep.

[dimisdas]

https://www.wow-europe.com/login/log...p://google.com

In this page you must fill in your World Of Warcraft Username and Password. That work for Blizzard, but then it does not take you to WoW managment page but to Google.com ( service=http://google.com ). So after he write his details you redirect him to a scam login page where it will say: Password or Username is wrong. So he will have to write them down again. Bingo!

[brendanec]

best of luck here

[Xronis]

Yea, doesn't work.

[dimisdas]

Yea, doesn't work.

In order for it to redirect you need to enter a valid WoW account username and password! It will check if they are OK and then it will redirect you to the service url.

[7itanium]

HOLY CRAP--

CONFIRMED-- I just got it to work-- this is an UBER find my man-- you will go down in history for this one

+rep wish I could give more than 1

[Verye]

Really?

Really?

If this actually works then...you'd be hailed as a God.

I can't imagine no one else has ever noticed though. Does anyone else have any proof that this works? It seems very unbelievable, and you'd think Blizzard would've noticed it. If not, you'd think someone else would've posted it before.

I gave you 4 rep; that'll get you out of leecher status and let you post links and images and such. Make a picture guide for us, and if it all works, then...congratulations on your amazing discovery.

[7itanium]

Really?

Really?

If this actually works then...you'd be hailed as a God.

I can't imagine no one else has ever noticed though. Does anyone else have any proof that this works? It seems very unbelievable, and you'd think Blizzard would've noticed it. If not, you'd think someone else would've posted it before.

I gave you 4 rep; that'll get you out of leecher status and let you post links and images and such. Make a picture guide for us, and if it all works, then...congratulations on your amazing discovery.

I didnt believe it either-- but I just tried it and it really is CONFIRMED

cant believe I have never seen this-- something overlooked for so long-- I already have it setup to my phisher and its working like a charm

[amnesia]

HOLY SH*T.
I'll give ya my only rep point I have lol <3

[Verye]

As I said, I'd like him to take some screenshots and make a step-by-step guide.

[dejavu11]

Seems like trying this on US servers without anything but worldofwarcraft.com for the service variable is throwing a 500 error.

[Machingunner]

Yeah, it works!

[polarmike76]

I can't seem to get it work with the US one =\

[tomoboi]

As I said, I'd like him to take some screenshots and make a step-by-step guide.

Me two, get some screenshots up