John Wood

Well, Received my first LOTRO password account reset notice. Get it alot from when i played WoW but LoTRO? Seems with Warner Bros purchase of LoTRO, they have since reduced their account security associated.

Did some research and found some information.

Email Header Info:

Return-Path: Received: from blu0-omc3-s19.blu0.hotmail.com [65.55.116.94] by sm07.internetmailserver.net with SMTP; Sun, 16 May 2010 20:27:23 -0700 Received: from BLU0-SMTP23 ([65.55.116.72]) by blu0-omc3-s19.blu0.hotmail.com with Microsoft SMTPSVC(6.0.3790.4675); Sun, 16 May 2010 20:27:23 -0700 X-Originating-IP: [222.69.178.82] X-Originating-Email: [krebs.adi@hotmail.com] Message-ID: Return-Path: krebs.adi@hotmail.com Received: from vhbehu ([222.69.178.82]) by BLU0-SMTP23.blu0.hotmail.com over TLS secured channel with Microsoft SMTPSVC(6.0.3790.4675); Sun, 16 May 2010 20:27:21 -0700 From: "cogaccounts@codemasters.com" To: Subject: SPAM-LOW: Turbine Account Status Warning Date: Mon, 17 May 2010 11:27:07 +0800 MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_NextPart_000_05BE_015FC95B.129F0170" X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2900.5512 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.5512 X-OriginalArrivalTime: 17 May 2010 03:27:22.0857 (UTC) FILETIME=[DD214D90:01CAF570] X-SmarterMail-Spam: SPF_Pass, SpamAssassin 18.125 [raw: 5.8], DK_None X-SmarterMail-TotalSpamWeight: 18

Email Content:

fication regarding the recent change(s) made to your the Lord of the Rings Online. Your password has recently been modified through the Password Recovery website.

*** If you made this password change, please disregard this notification.
However, if you did NOT make changes to your password, we recommend you Login to verify your password:

https://cogaccounts.codemasters.com/

If you are unable to successfully verify your password, using the automated system, please contact Billing & Account Services at 1-960-67-TURBINE (1-960-595-4588) Mon-Fri, 8am-8pm Pacific Time or at billing@turbine.com.Account security is solely the responsibility of the account holder. Please be advised that in the event of a compromised account,

Turbine representatives typically must lock the account. In these cases the Account Administration team will require faxed receipt of ID materials before releasing the account for play.

Regards,

The Lord of the Rings Online Support Team Turbine Entertainment

some info on the link provider: https://www.turbine-account-master.net (obviously not a valid turbine account

trace route info:

Now why is it that they would be masked from the domain space provider on? Wondering if its the China or Russian gold sellers? Waiting for my pending traceroute from hotmail in regards to the email that was sent to me by the hotmail account above.

Who is info on the last registered domain in the traceroute: AS5577.net