Guild Wars 2

I just got a Phishing E-mail in my junk box last night at around 4pm while I was playing guild wars so I figured I would post it here to help people realize just how careful you need to be when you get these E-mails as this one could most likely pass for a real E-mail. Almost fooled me if not for the fact I was still playing when and after I got it, and can still log in as of posting this.

Greetings,

I have also received a phising email, it was signed by GM Cuache stating that I have been trying to do illegal transactions, when I clicked the link google advised me that it was a phising site and I did not go any further, I though it was weird since last I played in GW 2 was like 1 week ago and I only have one friend there.

hi all

do some know i got a email saying this

Guild Wars 2 Account Will Be Shut Down Inform

We are sorry to inform you that your login account ……..@….. will be shut down or partially limited within 72 hours due to currency transactions or abnormal login. If you want to remove restrictions, please click the following link to validate:
https://account.guildwars2.com/login?
Please keep in mind that Guild Wars 2 is a global game with hundreds of thousands of players. This means that standards of behavior must be upheld. For your convenience, you can obtain more information about our rules at the address listed below.

https://www.guildwars2.com/en/legal/

Guild Wars 2 Account Support Team

warfundk

Do not click the links! That email is a scam to steal your account information.

If you did click one of those links, you need to check your computer for key loggers and other malware that might have been installed when you visited their web site and then contact support immediately to get your password changed. Do it now because they will use your login information you provided them to steal your account and all your in game stuff.

Check out this message thread which talks about these phishing emails.
https://forum-en.gw2archive.eu/forum/support/account/e-Mail-from-ArenaNet-Please-read-merged/first

thanks 1000 time for that

no i have not click on the link

warfundk

Today I got this email.

Scary huh? This email is obviously fraudulent with a fairly good email spoof designed to harvest your account email/password, add you to a botnet, then drain all gold and other valuables from your account.

As I have never given this accounts email out to anyone, I can only assume that somehow the GW2 email database has been owned by someone and now public to spammers.

Please remember to watch your accounts for suspicious activity, turn on two factor authentication, and of course don’t give out your password to strangers (or use 123password).

There is no security leak in Guild Wars 2’s database.

https://forum-en.gw2archive.eu/forum/support/account/A-Note-about-Phishing-Emails-1/first#post2074388

People get phishing emails for games and/or products they have never even owned.

Can we see metrics of those registered for GW2 and those not registered for GW2? Because if someone creates an email exclusively for GW2 and they STILL get phishing emails, then that is a cause of suspicion.

For all who do not know, I will keep this simple.

No matter what E-mail you get from Arenanet. They will never ask for your username and/or password. Why? They already have it. The end.

Anet has said that any legit email from them will NOT contain links. If you get an email with a link, and you’re really worried, do NOT click on it. Go to guildwars2.com by typing it into your browser, and then go to the support area. Send in a ticket, and ask if your account is under investigation.

A new Phishing mail. What really wonders me is the set token, request and IP (XXXed in the text below) in the link. May that be done by my browser, that runs both forum login and email client in different tabs? If yes, can the sender steal that in any way?

Greetings!

It has come to our attention that you are trying to sell your personal
Guild Wars account(s). As you may not be aware of, this conflicts with the
EULA and Terms of Agreement. If this proves to be true, your account can
and will be disabled. It will be ongoing for further investigation by
ArenaNet Entertainment’s employees. If you wish to not get your account
suspended you should immediately verify your account ownership.

You can confirm that you are the original owner of the account to this
secure website with:

https —-- ://account.guildwars2.com —-- /allow-login?token=XXXX&request=XXXXX&ip=XXXXXX.html

If you ignore this mail your account can and will be closed permanently.
Once we verify your account, we will reply to your e-mail informing you
that we have dropped the investigation.

Regards,

Account Administration Team
Thanks! —The ArenaNet Team

The phishing link Links made unclickable by —- :
———
http —- :// —- support.guildwars2.com. —- ghtr.co.vu/

There was another topic about this where admins were telling players to watch out for fake email and i have just received one and i wanted to remind and put the email of the person up to people can look at it and see what they have done to look like they are from Areananet. Ok so these people say my account is going to be removed and so on FAKE!, The Email they used to try and fool me was “Mailto:noreply@guildwars2.com”.

Do not click any link about your account being Removed it is always fake because your account would probably not be removed as it it is not necessary. Here is what they said without the links.

We regret to inform you that within 72 hours, your account will be closed. Since landing currency transactions or unusual. If you want to remove restrictions, please click the link below to verify: (Link)

If you ignore this information to your account,and can be closed permanently.

Remember that Guild Wars 2 is a global game with thousands of players. This means that we must adhere to standards of conduct. For your convenience, you can get more information about our rules at the following address.
(Link)

greetings,

Universal Cuache
Guild Wars 2 Support Team

(Link)

Hi, I just received this email below. I was warned by the browser that the link mentioned in the email is a phishing website. Is this an official email? Because I never tried to sell my account!

Greetings!

It has come to our attention that you are trying to sell your personal Guild Wars account(s). As you may not be aware of, this conflicts with the EULA and Terms of Agreement. If this proves to be true, your account can and will be disabled. It will be ongoing for further investigation by ArenaNet Entertainment’s employees. If you wish to not get your account suspended you should immediately verify your account ownership.

You can confirm that you are the account to this secure website the original owner. Please copy the following link into your browser:

http://account.guildwars2-recovery.com

If you ignore this mail your account can and will be closed permanently. Once we verify your account, we will reply to your e-mail informing you that we have dropped the investigation.

Regards,

Account Administration Team
Thanks! —The ArenaNet Team

I haven’t played GW2 for a little while.

but I’ve been getting these emails. I assume these are fakes as well. though the email address is the same as the companies one so who knows.

I’ve added the link in the email but I see what they are doing.

It’s a link of the allow network into this account, and once you click on the link it’ll allow the network.

the ip on the link is 62.150.38.163

this is the details on this ip.

IP : 62.150.38.163 Neighborhood
Host : xdsl-62-150-38-163.qualitynet.net Not OK
Country : Kuwait

Domain Name: QUALITYNET.NET
Registry Domain ID:
Registrar WHOIS Server: whois.kuwaitnet.net
Registrar URL: http://www.kuwaitnet.net
Updated Date: 19-Sep-2013
Creation Date: 27-Sep-1998
Registrar Registration Expiration Date: 26-Sep-2018
Registrar: Kuwaitnet Internet Services
Registrar IANA ID: 835
Registrar Abuse Contact Email: whoisabuse@kuwaitnet.net
Registrar Abuse Contact Phone: +9651807060

Greetings!

It has come to our attention that you are trying to sell your personal Guild Wars account(s). As you may not be aware of, this conflicts with the EULA and Terms of Agreement. If this proves to be true, your account can and will be disabled. It will be ongoing for further investigation by ArenaNet Entertainment’s employees. If you wish to not get your account suspended you should immediately verify your account ownership.

You can confirm that you are the original owner of the account to this secure website with:

link to allow ip address.

If you ignore this mail your account can and will be closed permanently. Once we verify your account, we will reply to your e-mail informing you that we have dropped the investigation.

Regards,

Account Administration Team
Thanks! —The ArenaNet Team

I was getting these e-mails even before I bought the game.

Becka Williams.4978:

Anet has said that any legit email from them will NOT contain links. If you get an email with a link, and you’re really worried, do NOT click on it. Go to guildwars2.com by typing it into your browser, and then go to the support area. Send in a ticket, and ask if your account is under investigation.

This. No Anet support email that is not in response to you sending in a help request will have a link.

Seigfried.5938:

Hi, I just received this email below. I was warned by the browser that the link mentioned in the email is a phishing website. Is this an official email? Because I never tried to sell my account!

Greetings!

It has come to our attention that you are trying to sell your personal Guild Wars account(s). As you may not be aware of, this conflicts with the EULA and Terms of Agreement. If this proves to be true, your account can and will be disabled. It will be ongoing for further investigation by ArenaNet Entertainment’s employees. If you wish to not get your account suspended you should immediately verify your account ownership.

You can confirm that you are the account to this secure website the original owner. Please copy the following link into your browser:

http://account.guildwars2-recovery.com

If you ignore this mail your account can and will be closed permanently. Once we verify your account, we will reply to your e-mail informing you that we have dropped the investigation.

Regards,

Account Administration Team
Thanks! —The ArenaNet Team

This is a fake -aka phishing – support email.

Unless you have requested help, there is only ONE instance in which support will email you about a violation : Chat violations. And there will be NO LINKS in that email. Anything else (including selling gold or your account) they will lock your account and wait for you to contact them.

If you view that link, you’ll notice the website isn’t simply www.guildwars.com or support.guildwars2.com – that’s one clue. As I just mentioned, the fact that they were clickable is another clue.

Kain Francois.4328:

Can we see metrics of those registered for GW2 and those not registered for GW2? Because if someone creates an email exclusively for GW2 and they STILL get phishing emails, then that is a cause of suspicion.

LOL!
Not sure if your just trying to be funny or not, but just in case.
How do you propose anet gets a list of how many people who do not have accounts so are not customers, get fake emails? I suppose they could try contacting the NSA and see if they have any information… ;-)

FYI, I get email for to reset my Blizzard Sony, and EA accounts all the time.

BTW, I have never had a Blizzard, Sony or EA account.

ShiningSquirrel.3751:

Kain Francois.4328:

Can we see metrics of those registered for GW2 and those not registered for GW2? Because if someone creates an email exclusively for GW2 and they STILL get phishing emails, then that is a cause of suspicion.

LOL!
Not sure if your just trying to be funny or not, but just in case.
How do you propose anet gets a list of how many people who do not have accounts so are not customers, get fake emails? I suppose they could try contacting the NSA and see if they have any information… ;-)

FYI, I get email for to reset my Blizzard Sony, and EA accounts all the time.

BTW, I have never had a Blizzard, Sony or EA account.

Oh c’mon Squirrel, we all know that ANet owns the interwebs!

Zen.2450:

Today I got this email.

Show Spoiler

hide spoiler

Greetings!

It has come to our attention that you are trying to sell your personal Guild Wars account(s). As you may not be aware of, this conflicts with the EULA and Terms of Agreement. If this proves to be true, your account can and will be disabled. It will be ongoing for further investigation by ArenaNet Entertainment’s employees. If you wish to not get your account suspended you should immediately verify your account ownership.

You can confirm that you are the original owner of the account to this secure website with:

https://account.guildwars2.com/allow-login….. Rest of link withheld to protect the idiots who might click it. :/

If you ignore this mail your account can and will be closed permanently. Once we verify your account, we will reply to your e-mail informing you that we have dropped the investigation.

Regards,

Account Administration Team
Thanks! —The ArenaNet Team

Scary huh? This email is obviously fraudulent with a fairly good email spoof designed to harvest your account email/password, add you to a botnet, then drain all gold and other valuables from your account.

As I have never given this accounts email out to anyone, I can only assume that somehow the GW2 email database has been owned by someone and now public to spammers.

Please remember to watch your accounts for suspicious activity, turn on two factor authentication, and of course don’t give out your password to strangers (or use 123password).

You assume incorrectly. Perhaps you should use google and look at the different methods that are used to harvest email addresses. One of them being sending an email to millions of possible email combinations – one of the correct ones happened to be yours.

i got the same email today, obviously anet is aware and its fake so moving on. here it is incase anyone else gets it too:

Account Ownership
ArenaNet
To Me
Today at 8:47 AM
Greetings!

It has come to our attention that you are trying to sell your personal Guild Wars account(s). As you may not be aware of, this conflicts with the EULA and Terms of Agreement. If this proves to be true, your account can and will be disabled. It will be ongoing for further investigation by ArenaNet Entertainment’s employees. If you wish to not get your account suspended you should immediately verify your account ownership.

You can confirm that you are the original owner of the account to this secure website with:

https://account.guildwars2.com/allow-login?token=E4627223-9087-4AC4-8BC7-9784C48EE197&request=E553AB6A-4825-4E6C-A278-00A2C6C305A9&ip=62.150.38.163.html

If you ignore this mail your account can and will be closed permanently. Once we verify your account, we will reply to your e-mail informing you that we have dropped the investigation.

Regards,

Account Administration Team
Thanks! —The ArenaNet Team
Reply, Reply All or Forward | More

I haven’t logged into GW2 for a while, and was clearing thru my spam folder and found this message

ArenaNet noreply@guildwars2.com
Jan 16

to me

Guild Wars 2 Account Will Be Shut Down Inform

We are sorry to inform you that your login account {redacted}will be shut down or partially limited within 72 hours due to currency transactions or abnormal login. If you want to remove restrictions, please click the following link to validate:
https://account.guildwars2.com/login?
Please keep in mind that Guild Wars 2 is a global game with hundreds of thousands of players. This means that standards of behavior must be upheld. For your convenience, you can obtain more information about our rules at the address listed below.

https://www.guildwars2.com/en/legal/

Guild Wars 2 Account Support Team

Should I be concerned or is this just a poor attempt at phishing?

Poor attempt at phishing. It’s been pasted a lot. Lol

https://forum-en.gw2archive.eu/forum/support/account/A-Note-about-Phishing-Emails-1/

Also see there

Greetings

We are sorry to inform you that your login account [redacted] will be shut down or partially limited within 72 hours due to currency transactions or abnormal login. If you want to remove restrictions, please click the following link to validate:
removed phishing link

We will investigate into this case through verifying the account’s ownership. If the verification goes through, we will cancel any restriction.

Please keep in mind that Guild Wars 2 is a global game with hundreds of thousands of players. This means that standards of behavior must be upheld. For your convenience, you can obtain more information about our rules at the address listed below.

https://www.guildwars2.com/en/legal/

GM Cuache
Guild Wars 2 Support Team

this is the message i keep receiving i would ask gw2.com to please take me off all the public bits of the forum including my email address i get about 60 of these messages a day and i for one are sick of them all i want is to be able to play this game in peace please take my email address off all public bits of your site and please make sure you better handle my info in the future i aint opted to have my email sent out to 3rd parties (or account hackers) so can you please sort it out so none of my info is shown to these third party websites

That is a phishing email. That is a thief trying to steal your account information. It is not ArenaNet sending it to you.

You can take a look at this sticky post and see what is going on.
https://forum-en.gw2archive.eu/forum/support/account/A-Note-about-Phishing-Emails-1/first#post3557700

Bumping is not allowed by the forum rules

Hey,

Pretty alarming email saying my account might be shut down or limited unless I click this link in my email.

Any idea how I can go about this? Maybe speak to support, I don’t really want to click the link, with phishing and all.

It’s fake. Ignore or delete the e-mail.

tone.2961:

Hey,

Pretty alarming email saying my account might be shut down or limited unless I click this link in my email.

Any idea how I can go about this? Maybe speak to support, I don’t really want to click the link, with phishing and all.

Long story short : The only contact support will initiate uses an email with no links at all in it, and deals only with chat violations. Otherwise, if it has links and you never contacted support, delete it.

How do they get the sent from email “noreply@guildwars2.com” in their phishing emails?

is guildwars2.com not owned by anet?

dan.3618:

How do they get the sent from email “noreply@guildwars2.com” in their phishing emails?

is guildwars2.com not owned by anet?

It’s called “spoofing”. Anyone can make their email address look like anything. Have you ever gotten a spam email that appears to have been sent to you, from you at the same address?

They’re not actually sending from guildwars2.com, they’re just making it look that way. Think of it as a mask worn over the real address.

I recently got an email from ArenaNet saying I attempted to sell my account. They threatened to permanently disable my account. I know absolutely sure that I did NOT attempt to sell my account. I don’t know how anyone would have gotten my information, I haven’t given my email or password out to anyone. At the end of the email there was a link to the GuildWars2 site, they said to go to the link and send confirmation that I am the owner of the game. I sent them confirmation that I am the owner of the game. After I sent in confirmation I hit “Login” it brought me to a different link that was in a different language, Japanese I believe. Using a Google translater, I found out that it said “This is a Broken Link” Upon realizing, that the email may have not come from ArenaNet at all. I Immediately changed my password.

I am posting this thread in the hopes that ArenaNet will recognize that I am the original owner of this account and try to resolve this situation and to put on record that, “I did NOT attempt to sell my account.”

The email did not come from ArenaNet, they did not accuse you of anything. It’s a “phishing” attempt from a hacker in order to gain access to your account. Because you changed your password you should be safe, and Anet has not accused you of doing anything nor will you face any kind of punishment from them.

Ok. That make much more sense. Thank you for the reassurance. I appreciate it.

Just to also point out if you use that email address along with the password on any other site at all I would change it. Another good rule would be to never use the same email/password on any site, with that of another site. Once one of these agencies know that was a valid combination they could sell or even use it on their own to try to access other sites.

I received an email from noreply@guildwars2.com: says as follows:

Greetings

We are sorry to inform you that your login account [[[ACCOUNT NAME REDACTED]]] will be shut down or partially limited within 72 hours due to currency transactions or abnormal login. If you want to remove restrictions, please click the following link to validate:
[[[LINK REDACTED]]]

We will investigate into this case through verifying the account’s ownership. If the verification goes through, we will cancel any restriction.

Please keep in mind that Guild Wars 2 is a global game with hundreds of thousands of players. This means that standards of behavior must be upheld. For your convenience, you can obtain more information about our rules at the address listed below.

https://www.guildwars2.com/en/legal/

GM Cuache
Guild Wars 2 Support Team

Is this legit?

no it’s not

Please remove the link from your post to avoid accidantal clickign by others. This is a phising mail.

Another one to add to the list of variations. I got this yesterday, just noticed it when I went to clean out my inbox, waiting for important mail.

The big blocks are (1)my own e-mail and (2)the fake link. The “Image” box up top appears to be the GW2 logo when loaded. The e-mail subject was “Guild Wars 2 – Account Verification.”

Not that it helps much, but I felt the need to post it.