Guild Wars 2

Ok, so it was pure coincedence that the phishing email was sent after legitimate login verification emails from Arenanet. I apologize to the community for my foolish obstinance in the face of the obvious and thank you for your insistence. Hopefully the damage has been mitigated

This morning I received this email:

Greetings!

It has come to our attention that you are trying to sell your personal Guild Wars account(s). As you may not be aware of, this conflicts with the EULA and Terms of Agreement. If this proves to be true, your account can and will be disabled. It will be ongoing for further investigation by ArenaNet Entertainment’s employees. If you wish to not get your account suspended you should immediately verify your account ownership.

You can confirm that you are the original owner of the account to this secure website with:

If you ignore this mail your account can and will be closed permanently. Once we verify your account, we will reply to your e-mail informing you that we have dropped the investigation.

Regards,

Account Administration Team
Thanks! —The ArenaNet Team

I am not selling my account. and this seems like a scam to get me to insert my password. please advise.

I almost fell for it but changed my password instead before I did anything else. hope no one else fell for it.

https://forum-en.gw2archive.eu/forum/support/account/SCAM-Emails-False-accusations-about-account-selling/first

Please remove the phishing email’s link, so others don’t inadvertantly click on it, as per the above thread.

i received the same e-mail in a e-mail address that i even don’t use for GW2 … if you mouse over the link ( without clicking it ) you will see the true link in your status bar in your web browser …. of course it’s always false … in this case its account.guildwars2.com.zhzq.info the ‘’ zhzq.info ’’ is suspicious

OK sure fire test is enter some fake info for email and password, if it goes through its fake, which is what this one did with me

got same one at 9:00 AM

Ah THWML. well if my accounts gone by the tiime I get back home today after work I’ll know that my E-mails can no longer be trusted. I did change my password(s) 3 times but I’m sure that isn’t gonna be enough. Guess I’ll wait to see of my virus scanner picks up anything.

DarkDemon.7645:

OK sure fire test is enter some fake info for email and password, if it goes through its fake, which is what this one did with me

I strongly advise against doing this, as simply visiting the website in question may be enough to get your PC infected with a keylogger.

The text of the scam e-mail going around is almost word for word to that of other scam e-mails going around for World of Warcraft, Runescape and Diablo 3. It can therefore be dismissed as a phishing attempt. To check whether a link is genuine, hover your mouse over the link, right-click and select “Copy URL location” or “Copy shortcut”. Paste that text into a text editor like Notepad or Word and see whether the location it’s sending you to matches the link’s text. Usually you’ll find that it sends you to a fake site, but some can be cleverly disguised like “account.arenanet.tfoh.com”

Greetings!

It has come to our attention that you are trying to sell your personal Guild Wars account(s). As you may not be aware of, this conflicts with the EULA and Terms of Agreement. If this proves to be true, your account can and will be disabled. It will be ongoing for further investigation by ArenaNet Entertainment’s employees. If you wish to not get your account suspended you should immediately verify your account ownership.

You can confirm that you are the original owner of the account to this secure website with:

[link removed]

If you ignore this mail your account can and will be closed permanently. Once we verify your account, we will reply to your e-mail informing you that we have dropped the investigation.

Regards,

Account Administration Team
Thanks! —The ArenaNet Team

The email it’s coming from is noreply@guildwars2.com

Now I don’t normally have to ask about this stuff. I’ve got fishing emails before, but this one actually looks like it could possibly be legit. Following the link brings me to a site that does look like the GW2 site, but I haven’t entered any information onto it yet.

The thing is I have not tried to sell my account at all, so I have no idea why they think I have. It could be because I have to allow access to my account every time I try to log into the game and the access always has it listed as coming from a different IP address, but that’s ArenaNets problem, not mine. I haven’t ever tried to log onto the game from any other computer but this one, and my IP address is static. I heard its a hotmail problem, and it concerns me that they think I’m trying to sell my account because they can’t get their own network working properly.

Anyway, my main question is, is this legit?

Edit: It should probably be noted that I have recieved this email twice.

No it’s not, it uses the same format as it’s other phish type emails for other mmos like wow etc.

They probably would have banned you first to begin with rather than give you a warning before email if they found out you were trying to sell your account. Then you could proceed to submit a ticket to get it back etc.

Although the email noreply@guildwars2.com is indeed Anet’s legit system email, it is not hard to falsify the sender email these days.

I just got the same mail…just ignored it.

Phishing email.

Though receiving such mail does mean that you’ve done something or been compromised some way that they manage to get your email details. However the security of your account is not in question of course.

For me, the fact that i get those emails on the wrong email means that they can get emails from guildwars 1 and not from the 2. Maybe we can see player’s email on the website of anet.

Got this mail today. I get the same e-mail for all mmorpg games I play. Seems like the only thing they change is the name of the game. How do they get my e-mail address? I only get these phishing mails for games that I play…

Yeah.. just got the same email. The fact it went straight to my junk folder instead of my inbox like the rest of the GW2/Arena emails do sent up a red flag immediately.
The look-alikes can be pretty convincing, got to look out for wording. Also good to come check the official site separately. I get similar emails, even for games I don’t play, but this one was surprisingly more realistic than the others tend to be. Stay net-safe, friends.

I suggest you guys change your email address for guildwars 2, your probably in their mailing list. I received this mail too but on my old email where I registered GW2, but I changed email and I don’t have it there.

So! Change your email address for GW2.

I’ve had a few of these coming in today and yesterday. I think they were still trying to get these right day before yesterday, as I got one titled for Diablo 3, but contents dealing with GW2 (see attachment).

ya i got one as well today. pretty surprise at first but a quick mail to support sort it out
funny thing the mail frm support actually got flag as (Be careful! This sender failed our fraud detection checks ) 0.o! stupid outlook …..

also i cant block that email address frm the scammer because its the same mail anet uses when sending authorize log in frm a driff ip

Hi!
I got this e-mail from….i think that from someone who wants my account.

So here it is:
Greetings!

It has come to our attention that you are trying to sell your personal Guild Wars account(s). As you may not be aware of, this conflicts with the EULA and Terms of Agreement. If this proves to be true, your account can and will be disabled. It will be ongoing for further investigation by ArenaNet Entertainment’s employees. If you wish to not get your account suspended you should immediately verify your account ownership.

You can confirm that you are the original owner of the account to this secure website with:

https://account.guildwars2.com/allow-login?token=E4627223-9087-4AC4-8BC7-9784C48EE197&request=E553AB6A-4825-4E6C-A278-00A2C6C305A9&ip=62.150.38.163.html

If you ignore this mail your account can and will be closed permanently. Once we verify your account, we will reply to your e-mail informing you that we have dropped the investigation.

Regards,

Account Administration Team
Thanks! —The ArenaNet Team

It redirects me to this link:
http://account.guildwars2.com.j292x6.info/

I’am confused because it came from this e-mail: “ArenaNet” (noreply@guildwars2.com
This is the same e-mail that send me a massage when i change password etc.
I’m sure that this is not the officional webpage, but iam afraid of that my account will be disabled. So i request some advice what should i do?
I won’t enter my info there beccause its not the true website it’s fake.
So i want to get some information of my account. Is there really an investigation? If yes how can i verify that i"am the owner? (with serial? No problem i have it)

Note: My account was recently hacked and someone from Canada played with my account in the last 1-2 or 3 month. I recovered my account and i’am using it again. (Luckily my characters was not deleted.

Thanks for the help in advance.
Regards,

Sh|fty

I’ve received at least a dozen emails in the past three days.

Stop.

These emails are not from Anet. Don’t click on the links. It’s a phishing scam.

Just got one myself, but not on the actual email I use for GW2. It came on the old one.

just got a email telling me someone from china tried to login to my account and it needed to be authorized..

now my password is prolly one of the tougher ones (obviously cant say anything else) but i know for a fact this one would be like 1 in a billion to be bruteforced if even that

so im wondering if anet has looked over their network security, as ive seen quite a few people this has happened to

and honest to god, if my password has leaked somehow, im going to take legal action. im getting tired of gaming companies leaking personal info left and right and not taking responsibility for it.

You should not have clicked on that link. Change your password now, and you’d be wise to create a brand new email address for your account that you use for GW2 and nothing else.

Change it from the official places, not a link in the email.

I think so. I’m in the same position. Really long and complex password and no malware/virus/security problems. I don’t make random accounts with my good passwords and all the third party forum and fishy website accounts are made with disposable email and passwords.

And I’ve just got an email asking to authenticate a login attempt from China. This happened very recently (got the email on April 9th) and I expect Anet to release some sort of announcement on this unless this is a phishing attempt which I highly doubt.

Address: 124.239.72.60
City: Xingtai
Region: 10
Country: CN

I’ve now just changed my passwords to a much more secure one and added an mobile authenticator.

Honestly this cannot be a coincidence. Anet needs to do something about it.

yeah i never use my pass twice either, and running several rootkit scans along with bootscan and live protection, and its clean. on top of all that i also run malwarebytes 4 times a week, im 110% sure its not on my end and bruteforcing it just aint an option

“A log-in attempt from the following location is currently awaiting your authorization.

Address: 183.130.208.71
City: Wenzhou
Region: 02
Country: CN"

So does just clicking the link allow them access to your account, whether you’re signed in on the browser or not, or do you have to fill in details too?

You can’t blame anet for this one. Somehow someone has gained your account information somehow. Either by phishing or you used the same information on other websites/services that have been compromised. A lot of game websites have been hacked in the last two years.

Maximus.8376:

You can’t blame anet for this one. Somehow someone has gained your account information somehow. Either by phishing or you used the same information on other websites/services that have been compromised. A lot of game websites have been hacked in the last two years.

thats exactly why i blame ANET, cause

1. not the same password anywhere else, not even similar

2. ive been gaming since 1986 and never ever fell for a phishing attempt nor have i been hacked or had my comp infected in all these years

3. i dont click links i dont know for a fact points to something i need/want

4. i dont even open emails from an unknown sender, and if unsure i check the email header and do ip-lookups before i open it

5. yeah im basicly the “tinfoil hat man”

Exactly, what makes Anet so special? You can’t repeat the same old “phished and using same info” when it doesn’t even apply to us.

I feel kind of happen and sad about this. I’m happy because I to got this e-mail (only just) and feel like part of the gang now. I feel sad known that people are out to do this to other people.

Glad to know this is just a scam and you aren’t going to ban/delete my accounts.

this happened in RIFT by trion also, and they swore to god it wasnt on their side and we where basicly idiots for loosing our account info

2 weeks later they had to go out with a formal apology cause they had been compromised

also happened with diablo 3, it took months before they said they MIGHT have been compromised and suggested everyone should change their passwords right away

so ull have to excuse me if im a little inclined to think its anet turn this time

TO: ThePrettySavage.4801

Maybe, maybe Not it depends on if when you access the site a toggle is triggered to actviate a nasty program

I had this happen months ago. I immediately created a totally new email address and tied that new address to GW2 instead. That new email is exclusively for GW2 and nothing else, ever, period. Never had an issue again.

Funny, though, today I received a phishing email at the old address, the same one everyone else is getting. Go figure.

Change your email address, create a new one only for GW2. Then change you password while you’re at it. You’ll be happier.

Well necrofobic, maybe you are very carefull and all, but remember that it can me on an innocent news paper link that hackers putted their little virus such as keyloggers or any other stuff to get your information. It doesn’t matter how much tinfoil you are using. Be happy anet uses a system like this where even if the hacker get’s your password, they can’t get ingame (unless you are a total kitten and used the same one on the email).
So try to review all the stuff you did, since you are 100% sure that your password is unbreakable, they got it one way or an other

necrofobic.6975:

and honest to god, if my password has leaked somehow, im going to take legal action. im getting tired of gaming companies leaking personal info left and right and not taking responsibility for it.

You can try, but you won’t get very far. They are backed by a huge legal team, and they already covered themselves with that agreement you accepted at the beginning. Be thankful that the email authenticator caught it and they didn’t get in.

I changed my PW to an MD5 hsh code whic was generated from a 32character long pasword.
I can’t change my e-mail adress. How to change it?

I recived the same email that was directly sent to the spam folder. It was delivered in the email linked with the forum and not with the account.

Thanks for posting this thread. I’ve had three in the last three days. Usually the scam e-mails I get from WOW etc. go straight to the junk mail but this always pops up in my in tray. Is there anything arenanet can do as they do appear realistic at first? KUTGW

Did Arenanet get hacked? Coz the email address looks exactly the same as the official one? or did they just replace the “L” with and “i” in the “noreply”? I’ve received two emails already =/

Yep just got one of those as well. funny thing is it was to my old email before i changed it right after game launched.

kiwituatara.6053:

Did Arenanet get hacked? Coz the email address looks exactly the same as the official one? or did they just replace the “L” with and “i” in the “noreply”? I’ve received two emails already =/

Naw if you know what your doing you can make the e-mail say it came from whoever you want.

I just got one myself…figured it was phishing, but wanted to make sure. What really gives it away is they want you to click a link and enter your info. Duh!

My question is where are these scammers getting email addresses from? How are they targeting actual GW2 players and being so accurate? I mean there’s been A LOT of people complaining about this recently….

ShadyNZL.9018:

My question is where are these scammers getting email addresses from? How are they targeting actual GW2 players and being so accurate? I mean there’s been A LOT of people complaining about this recently….

More than likely they are geting them from compromised sites players visit. I get 2-3 of these a day in my junk mail box for my public email. Some are for games I used to play. Some, like this one, are from a current game I play. Others still are from games I’ve never played but once visited a fan site for while just browsing around.

Picture this senario. You register for the forums at FansiteX. If FansiteX is really lax perhaps your email you registered under is publicly avalible, easy pickings for phishing email senders to snap up emails of likely players. Even if FansiteX is more security conscious their databases are rarely as secure as a larger corporations and may be hacked. Those hackers now have your email address and may even add a script to the website that attempts to look at your cookies next time you visit to see what other game sites you visit. They can now “Tailor” their phishing attempt for you to target games you either play or at least have a passing interest in.
In reality those emails are a form leter with a few fill in the blank spots they change depending on the game they think you are playing. Right now I have emails in my junk folder for GW2 WoW, Diablo3, RuneScape, and several others that are 95% identical text and I never even played RuneScape or Diablo3. Honestly I wouldnt have even noticed these GW2 ones other than the fact that a couple showed up in my main box instead of my junkmail folder.

Got the same email, delivered directly to my junk folder.
The address where I got this is the same associated to the official and non official GW2 forum and not to the game account.

VOLKON.1290:

Just got one myself, but not on the actual email I use for GW2. It came on the old one.

Same here, i just got one now but it came through to an old e-mail acc.
Stupid kittening e-mails i hete them :<