e-Mail from "ArenaNet?" Please read! [merged]
in Account & Technical Support
Posted by: Sky Heart.4932
in Account & Technical Support
Posted by: Sky Heart.4932
yea same, i just got an email like that, i think its time to make a new email to sign up to things… again :P sick of getting junk like this, i dont even play wow anymore and they still send those stupid emails
Ok guys i’m going to drop a not so secret here.
Email servers can send emails from any address they want without verification.
I can send you an email from my computer in my house to your email box that says its from noreply@arena.net
It isn’t even hard and can be done with a simple script. Or even manually, with a telnet connection.
Now a lot of email providers and ISP’s will attempt to verify it through all sorts of wizardry I wont get into here, and when it seems fishy to them they will put it in your junk folder or just might outright block it depending on the settings of the receiving mail server.
What can be useful to arenanet and your ISP provider is if you copy the header data of the email. This information contains the actual source of the email message, which is decidedly not arenanet.
Below is an example headerdata that proceeds an email message. I would recommend you not post it here unless you edit out your email address less hackers scanning the forums can use that to identify what email account belongs to your game account, but you can probably email arenanet support, and flag the message as spam without any real messages from arenanet getting blocked.
From IGN Deals: Mixed Bag Wed Apr 10 11:04:23 2013
X-Apparently-To: xxxxxxxxx@yahoo.com via 98.136.214.201; Wed, 10 Apr 2013 18:05:26 +0000
Return-Path: <mail@mail.ign.com>
Received-SPF: pass (domain of mail.ign.com designates 74.201.49.23 as permitted sender)
aG9wICYgYW4gSW5mcmFyZWQgUkMgSGVsaWNvcHRlciB3aXRoIEd5cm9zY29w
ZT8gRG9lcyB0aGlzIGUtbWFpbCBsb29rIGphY2tlZCB1cD8gVmlldyBhcyBh
IHdlYnBhZ2UgY2hyaXMsIFdlJ3JlIEZldGNoaW5nIHRoZSBCZXN0IERlYWxz
IFNvIFlvdSBEb24ndCBIYXZlIFRvLi4uLkh1cnJ5LCBNYW55IG9mIFRoZXNl
IEV4cGlyZSBEYWlseSBEZWZpYW5jZSAkNTkuOTkgKyBGUkVFIAEwAQEBAQN0
ZXh0L3BsYWluAwMwAgN0ZXh0L2h0bWwDAzY3
X-YMailISG: ShQUUJYWLDu8nbSVTswYIySj9wEoP2_ktZF4xrVylalnNIdu
JmEJqDTMVLGC2aTkFSirirCMjTPOGetRWwlhvQXNv4V6tVxPvXOzpcWWif1a
Ls5zSSqnlE6.l.1ZPg2MHoOY3_eaqwAP0BMftzST9fLPynHtHKp8mqK7NfmQ
rGLINbgNJnfzZxM0Lq9Ev9.kAh2wMlHJSaewyf1ScxbV_9klwRZMK7y0zMng
._YoVE1aBzwmki3R6Zmzdpqt_2x3MEIjdTHrsZPN1kItRgXmdaq8_A9v7m_L
0n8eYDoyQlT.9t0JDQHBX0vZ4xJp0C3EeNQQ3.0q6cnD9k46QI6vbd8UKs0B
VcZ86FvEoI_I9oVOLK2DXePPbrFPy5n6OI9zY2006wpzYTthqrs6hzcvDYY6
1PT1hZxwj_xP6t0YI02v4vL.HBT5OzF1fbCfP_EcS.vH5_a5Tpqai8bPvdLW
FoQdf4z7offaN955kOc3P6cpEqgpeZqtARGUxuEtNEDrkzcJSJhpxTaRUalO
d9I3uoWrpSwexJB1hI15hKW.87S3BBpE6emj2ac8hUckgpV12cnaP2H.pnRG
YA9ktmXantADtJYWSmaYQaScn852NH1.1yY_o8WWhxf06U7H8KUyG7U_LUHw
zP9Y_z6tl8r0wryIybRt3COrF_KSptZ4RO6SjJtKLTmFIPeSb37sXSfRsZXa
qB2mSfyhQ0WiLn8T6tBT68qQl6zQyqf9PskHaRq._oDQZvfHZF6eA2PNBETb
7943RVhUVf_TtjpNDfT1EVVmnan_xcdIjtryfLn0AJKgikIq66t5uZLklIMM
XEYdg90B3efcBLqYbYM7REjm1FEt4PFLP5rd9Zlu8CXIXvAbjTCl1_PmvGj9
gCsx7t99lsckJIzsvyzQKwWQDnFjFA5EKlD9GvEPb9KYF1BZDvePj5kJUh3F
OHytWELb7yIIes9UmeT13flRde73alwRijeMPLM18oumbfL7AQYdokittengw5j
A3A6SVfESVhrGT2SLuA7hmWB60Xbu.hctSpMXy4GOPnoW7gCNe36z9nhv9HQ
7OrY51wsVjUu31hZFF9GG3SECXTtnXjbDdmLUd6_eDhO44z5xBryqzK9fNrJ
czi0Ry8MLv4J.92gIWT4ROZN.TK8qONST9njlWVPazisa6TmI6CCcNWd257b
VDrhAcjOObdWRCsWtSOEL3AONVsm9M59vlYzafYBNaLnAY6W3AXKZy9TsHvS
HqL3_IvVU1pufvnK9_CRyRQF5BBor_N4qJ7U5YHbhwPxOkd9NpGs3wVVWTF6
C.kzSXxUrSDAieZoQZLWApc-
X-Originating-IP: [74.201.49.23]
Authentication-Results: mta1552.mail.ne1.yahoo.com from=mail.ign.com; domainkeys=pass (ok); from=mail.ign.com; dkim=pass (ok)
Received: from 127.0.0.1 (EHLO igndlbc.mail.IGN.com) (74.201.49.23)
by mta1552.mail.ne1.yahoo.com with SMTP; Wed, 10 Apr 2013 18:05:26 +0000
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=mail.ign.com; s=ign;
t=1365530663; bh=DlFriWAl8+LaQnetQPHTNUoMtLiUJ8qBjS6iyL/TnIw=;
h=DomainKey-Signature:Date:Message-Id:From:Reply-To:To:Subject:
MIME-Version:X-Mailer:List-Unsubscribe:Content-Type;
b=UN1mzjFDrVx38jZ915/aQpQCSNY55cxNyIvCvBfzCEqKt7RiF3rl1uuUc8uVz0gBr
kRUaOI2J5MaDUUalJ5Q1ei/utDSoYqXRlNOpldT1RpcvPqOBU742UenAHz3MNru
DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws;
s=ign; d=mail.ign.com;
h=Date:Message-Id:From:Reply-To:To:Subject:MIME-Version:X-Mailer:List-Unsubscribe:Content-Type;
b=K4GSpX1Plk/cbMGtTMdWBqvyTx6F0o4JB23oAXMY73lMdKtUMgCRtqJdHeQWXnLKWqevK9mmI7TT13+WkYAHk8QBjRysVvS7dbWQTf0V3R7UzHkfuJTEgN+bfB9UT39J;
Date: Wed, 10 Apr 2013 11:04:23 -0700
Message-Id: <1365617063.eb40.IGNM.765045.376053832MSOSI1.12OSIMS@mail.ign.com>
From: "IGN Deals: Mixed Bag" <deals@mail.ign.com>
Reply-To: "IGN Deals: Mixed Bag" <deals@mail.ign.com>
To: xxxxxxxx@yahoo.com
Subject: xxxxxxxxxxxxxxx
MIME-Version: 1.0
X-Mailer:ZetaMail50
List-Unsubscribe: <mailto:listunsub+LU+IGNM+765045+376053832+xxxxxxxxxx=yahoo.com@mail.IGN.com>
Content-Type: multipart/alternative; boundary="---===_OSI_MRIANVNII_16062001_31091.1365617063-7712"
Content-Length: 69859
(edited by Draygo.9473)
My question is where are these scammers getting email addresses from? How are they targeting actual GW2 players and being so accurate? I mean there’s been A LOT of people complaining about this recently….
They arnt being accurate at all (I know several email boxes that have been hit that don’t have guildwars 2 accounts). But part of it can be harvesting off of guild wars 2 fansites. Part of it is email addresses just harvested off of general gaming websites, and some of it is from the lists for wow accounts they already have. Scattershot that email, a few saps fall for it and then we get headaches. Fortunately arenanet has email verification on for most people, which should keep your gw2 account safe, but if your gw2 account and your email account share the same password both can be compromised.
in Account & Technical Support
Posted by: Elentari.9156
Mousing over the link in the email shows “guildwars2.thz-game.pw.”
I have merged two threads about this subject so that forum members could see the questions that others have had about the phishing email.
Again, do NOT click the link, and DO delete the email — it is bogus.
(edited by Gaile Gray.6029)
yea same, i just got an email like that, i think its time to make a new email to sign up to things… again :P sick of getting junk like this, i dont even play wow anymore and they still send those stupid emails
I usually use a different email address alias every time I sign up at a web site or service. Any email sent to the alias gets sent to my main email account. This way when I get spam I can look at the “to” field to see how the spammer likely got my email address.
It’s a pain to use a different email alias until you realize the benefits outweigh the disadvantages.
I received one of these e-mails today, and it made it into my regular inbox, not junk mail, which is pretty unusual. It’s consistent with the others, but the English is better. Is ANet collecting any information on these, taking any action, or shall we just delete and ignore and feel bad for the more gullible among us?
I just received one of these and was going to post a thread asking about it. I am glad to see it is a scam that is being addressed.
{removing link in case this exposes any account info}
(edited by Moderator)
I just received one of these and was going to post a thread asking about it. I am glad to see it is a scam that is being addressed.
{removing link in case this exposes any account info}
Hey there. I worry the image may show personal account info, and because we don’t need to see the image, I’ve redacted it. Hope you don’t mind!
Oh, and I’m glad this thread was helpful to you.
in Account & Technical Support
Posted by: Whoopmeister.7493
it makes u question the admin now tbh , has there been a breach of security , considering these people have managed to get hold of our emails , has there been a mention of this breach at all ?
in Account & Technical Support
Posted by: Nate Anabe.6091
Considering the fact that the one i got was to an email address that was not ever affliated with either Guild Wars its highly doubtful that a-net has been breached.
it makes u question the admin now tbh , has there been a breach of security , considering these people have managed to get hold of our emails , has there been a mention of this breach at all ?
If you use the same email address for multiple sites, that increases the chance of you getting spam or phishing emails. I use a different email address at almost every web site or service, and I can almost always tell which site sold my email address or was compromised. I started playing GW2 in August and also played GW1, and I have never received spam or phishing emails at the email addresses I used for them.
I just received one of these and was going to post a thread asking about it. I am glad to see it is a scam that is being addressed.
{removing link in case this exposes any account info}
Hey there. I worry the image may show personal account info, and because we don’t need to see the image, I’ve redacted it. Hope you don’t mind!
Oh, and I’m glad this thread was helpful to you.
Actually i edited out any info that would give away my account. I don’t really mind it being removed though.
in Account & Technical Support
Posted by: Adamentalist.3872
The recent light of these ‘emails’ i would like to know if you, Anet or Guildwars 2 have a security issue which is why are email addresses have been linked to Guildwars 2?
in Account & Technical Support
Posted by: lordkrall.7241
Doubtful.
These kind of mails have always been sent out, from different “companies” even without you having an account with that company (Blizzard comes to mind, where I have gotten WoW-notices for years without ever playing WoW or not having a Battle.net account.)
in Account & Technical Support
Posted by: Teofa Tsavo.9863
I would not worry much, the ones I get are yahoo bulk.. and I get them “apparently to” my account even if only the first 4 digits/numerals match. I’ve yet to see one addressed to my actual e-mail address. Most times they are not even the right domain name, or whatever that is. Im on Frontiernet and this phishing spam will send me stuff addressed to yahoo.net.
Four more emails from these clowns today alone. Well, they’re as persistent as they are annoying.
They’re not even going to the email I have my account tied to, which is relieving.
The recent light of these ‘emails’ i would like to know if you, Anet or Guildwars 2 have a security issue which is why are email addresses have been linked to Guildwars 2?
Considering the fact that the one i got was to an email address that was not ever affliated with either Guild Wars its highly doubtful that a-net has been breached.
ArenaNet has decidedly not been breached. This is an external effort and pretty easily detected as such.
I just received one of these and was going to post a thread asking about it. I am glad to see it is a scam that is being addressed.
{removing link in case this exposes any account info}
Hey there. I worry the image may show personal account info, and because we don’t need to see the image, I’ve redacted it. Hope you don’t mind!
Oh, and I’m glad this thread was helpful to you.
Actually i edited out any info that would give away my account. I don’t really mind it being removed though.
Oh thanks for doing that, Sylv. I have a tendency to act right away if I perceive there may be a privacy/security risk. Thanks for understanding.
Four more emails from these clowns today alone. Well, they’re as persistent as they are annoying.
They’re not even going to the email I have my account tied to, which is relieving.
You are very wise to use a separate email for your log-in, and not a general one that is more vulnerable to attack. (And yes, they are persistent. )
(edited by Gaile Gray.6029)
Ok guys i’m going to drop a not so secret here.
Email servers can send emails from any address they want without verification.
At least guildwars2.com and ncsoft.com are using SPF records though, so while a server can still try to send mails under their name, any decent spamfilter should sort it out unless any of these entries accidentially contain a spam relay, which I doubt.
guildwars2.com text = “v=spf1 include:mailgun.org ~all”
ncsoft.com text = “v=spf1 include:_netblock_rnw.ncsoft.com include:_netblock_global.ncsoft.com include:_netblock_global01.ncsoft.com include:sgizmo.com ip4:211.189.163.230 ip4:211.189.163.231 -all”
The arena.net domain lacks an SPF record btw.
in Account & Technical Support
Posted by: Shadow Novus.7321
Just got one today and thought “god kitten it, kittens are after my Guild Wars 2 account now.”
Been after my WoW and AION accounts for years…and I haven’t touched those games in years…
Glad to see ArenaNet is aware of the scam mails.
in Account & Technical Support
Posted by: Smooth Penguin.5294
I’m really happy this discussion is in the open forums for all to see. The more players are educated in these scams, the less complaints there’ll be about security breaches and such.
in Account & Technical Support
Posted by: DeathRogue.5492
The sick sad thing about the email to me is I got on. Just not in the email I registered my copy of the game with LoL. But yes I have it and I am reporting it .
in Account & Technical Support
Posted by: Azenthea.3692
A log-in attempt from the following location is currently awaiting your authorization.
Address: 124.228.44.162
City: Beijing
Region: 22
Country: CN
This location is approximated based on information provided by your Internet Service Provider. If in doubt, deny the request and try again.
If you are certain this log-in attempt was not made by you, then someone else knows your log-in credentials and you should change your password immediately via Account Management.
For security purposes, we alert you each time your account is accessed from an unrecognized location. To authenticate this log-in attempt, please click the link below:
Wars account? Visit our support site: http://en.support.guildwars2.com/
Thanks!
—The ArenaNet Team
(edited by Moderator)
in Account & Technical Support
Posted by: simplesimon.2084
means someone in China has your password. You should scan your PC and change your password
Perhaps this should be ‘stickied’? I received 4 of those emails and thankfully they landed in my junk folder. Since I never considered selling my account and it’s still up, pretty sure it’s a scam.
in Account & Technical Support
Posted by: danielrjones.8759
Hello, I just got an email. I did not click on the link. Is this a valid email? I am coping and pasting it below. I am in no way attempting to sell my account. I love this game far to much to even consider that. Seek advice from the community as how to proceed with this. Thank you all.
ArenaNet (noreply@guildwars2.com)
Add to contacts
4:54 PM
Greetings!
It has come to our attention that you are trying to sell your personal Guild Wars account(s). As you may not be aware of, this conflicts with the EULA and Terms of Agreement. If this proves to be true, your account can and will be disabled. It will be ongoing for further investigation by ArenaNet Entertainment’s employees. If you wish to not get your account suspended you should immediately verify your account ownership.
You can confirm that you are the original owner of the account to this secure website with:
If you ignore this mail your account can and will be closed permanently. Once we verify your account, we will reply to your e-mail informing you that we have dropped the investigation.
Regards,
Account Administration Team
Thanks! —The ArenaNet Team
(edited by danielrjones.8759)
in Account & Technical Support
Posted by: Inculpatus cedo.9234
That is a phishing email. Please remove the link therein. Ignore and delete the email, as it is a scam trying to get details on your account.
https://forum-en.gw2archive.eu/forum/info/news/E-mail-from-ArenaNet/first#post180786
in Account & Technical Support
Posted by: danielrjones.8759
Thank you Inculpatus. I did remove the link. I went into panic mode when I seen the email. I just read the link you provided before I came back to this one. I am at ease now.
in Account & Technical Support
Posted by: Inculpatus cedo.9234
I am happy to hear your fears are alleviated. Silly email scams! =)
Ok guys i’m going to drop a not so secret here.
Email servers can send emails from any address they want without verification.
At least guildwars2.com and ncsoft.com are using SPF records though, so while a server can still try to send mails under their name, any decent spamfilter should sort it out unless any of these entries accidentially contain a spam relay, which I doubt.
guildwars2.com text = “v=spf1 include:mailgun.org ~all”
ncsoft.com text = “v=spf1 include:_netblock_rnw.ncsoft.com include:_netblock_global.ncsoft.com include:_netblock_global01.ncsoft.com include:sgizmo.com ip4:211.189.163.230 ip4:211.189.163.231 -all”
The arena.net domain lacks an SPF record btw.
They should probably add one as it will help email providers to properly put these emails into the spam folder.
means someone in China has your password. You should scan your PC and change your password
Exactly, and by posting that link on the forum, now the spammer can click it and gain access to your account! I have reported this to the moderator.
@Anz
A moderator kindly removed the link from your post, but keep in mind if ANY reader on this forum clicked that link, hackers now have access to your account at this VERY MOMENT.
Please navigate to https://account.guildwars2.com/account/security and check to see if 124.228.44.162 is under authorized networks, if it is remove it right away!
In the future please refrain from copy/pasting confidential information from email, always be sure to remove activation email links!
And remember ArenaNet sent you that email because that hacker group already has your password, you need to change your GW2 account password ASAP.
in Account & Technical Support
Posted by: Old Bones.5140
Whelp, I finally got one. Should have searched before I made a post. Hmmm.
However, on a side note, I hope no one has the bogus email and perverted password I gave them.
Please note this thread for more information: https://forum-en.gw2archive.eu/forum/info/news/E-mail-from-ArenaNet/first#post1807866
in Account & Technical Support
Posted by: The Destroyer Erik.7628
Today i recieved this message:
"
Greetings!
It has come to our attention that you are trying to sell your personal Guild Wars account(s). As you may not be aware of, this conflicts with the EULA and Terms of Agreement. If this proves to be true, your account can and will be disabled. It will be ongoing for further investigation by ArenaNet Entertainment’s employees. If you wish to not get your account suspended you should immediately verify your account ownership.
You can confirm that you are the original owner of the account to this secure website with:
XXXXXX
If you ignore this mail your account can and will be closed permanently. Once we verify your account, we will reply to your e-mail informing you that we have dropped the investigation.
Regards,
Account Administration Team
Thanks! —The ArenaNet Team"
from: ArenaNet (noreply@guildwars2.com)
This is fake right?
(edited by The Destroyer Erik.7628)
It’s fake. FIRST delete the link you posted.
Then read this: https://forum-en.gw2archive.eu/forum/info/news/E-mail-from-ArenaNet/first#post1807866
longer thread here: https://forum-en.gw2archive.eu/forum/support/account/Email-from-ArenaNet-Please-read
But please delete that link.
Its purely fake, don’t think that link will work. If you hover over it – it probably isn’t going to guildwars2.com (in your email).
Delete that link from the forum if it is real, I notified a mod to have him remove it just in case you don’t see this.
in Account & Technical Support
Posted by: The Destroyer Erik.7628
Thank you for quick responding.
I deleted the link.
Mod, the topic can be closed.
Had a couple of these phishing scam emails, even before I bought GW2 hehe, and as an ex wow player, I don’t fall for them. However, I can’t find anywhere to report them to, do ArenaNet have a hacks address to forward them on to?
Also I’m assuming that if I set my outlook to block all emails from the sender it would block all legit emails from ArenaNet too, or can it differentiate between legit and faked senders via the message source details?
(edited by Utopia.2057)
in Account & Technical Support
Posted by: Kasumi Nightshadow.4962
I just received the same thing too, but I realized right away that it had to be a phishing scam. For those wondering how they got our emails, they just get a huge list of publicly made available emails from random companies, and send out mass emails to that list. I know cause I’ve never had a WoW account with Battlenet ever, and all the time I’m getting emails saying my account needs to be verified or its being sold for real money and my account is now banned til I do something about it. So yeah gotta love the phishing, scamming spammers of the world.
in Account & Technical Support
Posted by: Nate Anabe.6091
I use this when i get phishing email. Copy and paste url that is sent in email
http://www.google.com/safebrowsing/report_phish/?tpl=mozilla
make sure you are copying the target url, as often the phishers will make the link look like it is going to the proper destination.
This is the most recent email I got.
Greetings!
It will be ongoing for further investigation by ArenaNet’s employees.
We are concerned about whether your account has been stolen. In order to guarantee the legitimacy of your account, click the link below.
<their dumb link goes here>
Once your account authentication has been completed, we will check your account and let you know what we can do for you.
Need help or have questions about your account? Visit our support site: http://support.guildwars2.com/.
The Guild Wars 2 Team
When I click the link, the .com changes to .com.en and some other stuff.
It’s best to not click the link at all. Your browser will probably let you right-click the link (NOT left-click) and then select a menu option for copying the link’s target/destination location which you can then paste in a text editor. Or better yet, your browser might let you hover your cursor over the link to see the real destination.
in Account & Technical Support
Posted by: Azure Nemesis.5194
Apparently i recieved the same phishing-mail 5 days ago on an old (!!!) e-mailadress.
in Account & Technical Support
Posted by: danielrjones.8759
I have received that email 4 times now over the last 3 days. On my account and my kids account. Don’t understand why. Only websites I visit regarding GW2 is here, dulfy and guru. I hope people are aware. Having had my GW1 account stolen later returned after a hassle finding all the serial numbers. Good to see Anet is aware of it and posted about it.
Just as a reminder, please note this thread for more information: https://forum-en.gw2archive.eu/forum/info/news/E-mail-from-ArenaNet/first#post1807866
in Account & Technical Support
Posted by: ice ice baby.6083
Hi Just thought id bring this email to your attention.
Obviously its some kind of phishing email but thought i’d report it.
It was a link but i removed it just incase somebody was silly enough to click on it
- Pure
ArenaNet (noreply@guildwars.com)Add to contacts 21:48
To: xxxxxxxxxxxxxxxxx
Greetings!
It has come to our attention that you are trying to sell your personal Guild Wars account(s). As you may not be aware of, this conflicts with the EULA and Terms of Agreement. If this proves to be true, your account can and will be disabled. It will be ongoing for further investigation by ArenaNet Entertainment’s employees. If you wish to not get your account suspended you should immediately verify your account ownership.
You can confirm that you are the original owner of the account to this secure website with:
account.guildwars2.com/allow-login?token=E4627223-9087-4AC4-8BC7-9784C48EE197&request=E553AB6A-4825-4E6C-A278-00A2C6C305A9&ip=62.150.38.163.html
If you ignore this mail your account can and will be closed permanently. Once we verify your account, we will reply to your e-mail informing you that we have dropped the investigation.
Regards,
Account Administration Team
Thanks! —The ArenaNet Team
Gotten a new one today, don’t know if it’s real or not:
From: ArenaNet (noreply@guildwars2.com) This message is in your inbox because you’ve indicated interest in this sender.
Sent: Tuesday, April 16, 2013 12:14:28 AM
To:
“Greetings!
It will be ongoing for further investigation by ArenaNet’s employees.
We are concerned about whether your account has been stolen. In order to guarantee the legitimacy of your account, click the link below.
https://account.guildwars2.com/account/login-support.html
Once your account authentication has been completed, we will check your account and let you know what we can do for you.
Need help or have questions about your account? Visit our support site: http://support.guildwars2.com/.
The Guild Wars 2 Team"
And it has GW2 logo on top of the mail.
What is going on x.x
It’s fake. Just delete it. Don’t click the links. If you need to access your account for anything, type guildwars2.com in your browser and access your account that way.
Not affiliated with ArenaNet or NCSOFT. No support is provided.
All assets, page layout, visual style belong to ArenaNet and are used solely to replicate the original design and preserve the original look and feel.
Contact /u/e-scrape-artist on reddit if you encounter a bug.