Guild Wars 2

https://forum-en.gw2archive.eu/forum/support/account/A-Note-about-Phishing-Emails/first#post2035675

Hello everyone, I’m using an authenticator on my account and I’ve checked my account security and it says I only have my two IP addresses accessed to this account which is from my computer and my laptop, so no one hasn’t logged into my account from a different place other than my laptop and pc, but I keep getting loads of these GW2 Support emails and I’m too worried to click on the links they tell me to click on in case it’s a scam pretending to be ArenaNet.

The first email I got was this:
Account Security Alert: ArenaNet
noreply@guildwars2.com;
Greetings!

Due to an unusual change in your access pattern, the Guild Wars 2 account under this email address has been locked. This can be caused by logging in from a new location, but it may also signal an attempt to compromise your account. If you feel that your account’s security is at risk, please follow the steps below.

Step 1: Verify Your Account Ownership

Click on the link below to verify your e-mail address of the Guild Wars 2 account:

(And then here is a link telling me to click it to sort it out)

I have several of these emails also:

Guild Wars 2 Support
noreply@guildwars2.com;
Greetings!

It will be ongoing for further investigation by ArenaNet’s employees.

We are concerned about whether your account has been stolen. In order to guarantee the legitimacy of your account, click the link below.

Once your account authentication has been completed, we will check your account and let you know what we can do for you.

Need help or have questions about your account? Visit our support site: http://support.guildwars2.com/.

The Guild Wars 2 Team

Are these emails legit? I don’t see any reason for me to have any emails like these since I even checked security on this website and the only two IP addresses accessing my account are both my laptop and pc, so I’m really concerned.

Thank you for reading

They look like the phishing emails that are going around. ANet doesn’t normally contact people. They want you to contact them from their official site here if there is a problem with your account. If you try to log on and your account is blocked, then you contact them.

https://forum-en.gw2archive.eu/forum/support/account/A-Note-about-Phishing-Emails

Thanks guys, I’m just deleting them and ignoring because I can sign in perfectly fine on my account and play whereas the emails said it’s “locked” so it must be fake.

I today received an email, which Hotmail determined was sent by a safe sender, from GW2, it looks really authentic but my “Spidey-sense” was tingling so I didn’t click on the link provided by it.

Does Arena net send out such “click this link to confirm your account” emails? because the email address was exactly the same as the one used to send prior official emails, suggests to me that scammers may have somehow been able to send emails that appear to be authentic.

I can provide the link address for you to check, I didn’t include it in this forum post for security reasons.

I believe I have read here several times that Anet does not send out any account related emails unless you have initiated them yourself, for example requesting a password reset.

From my experience it is always safe to guess that emails asking for you to confirm an account are unsafe and this usually applies to emails regarding any account, not just GW2.

https://forum-en.gw2archive.eu/forum/support/account/A-Note-about-Phishing-Emails/first#post2035675

This should asnwer your question. Do not click that link!! it is indeed a Phish

The emailadres can easily be spoofed. The only thing outlook (formerly known as hotmail) does, is to check if it is an existing adress.

I figured as much, I was alarmed purely because they had somehow hijacked the official email address hence it showing up as on my safe list.

Basic rule of thumb. No legitimate company worth dealing with would ever send out an email asking you to confirm an account by clicking on a link. The only time you should ever see anything like that from any where, is if you open an account and they ask you to confirm your email before activating it.

Skuz.4856:

I figured as much, I was alarmed purely because they had somehow hijacked the official email address hence it showing up as on my safe list.

No one hijacked the email address. You can make the return address read anything you want.
Never trust just a return email as even most home users have the capability of changing it or “spoofing” it to any return address from any one, any where.

Skuz.4856:

I figured as much, I was alarmed purely because they had somehow hijacked the official email address hence it showing up as on my safe list.

In most emailclients you can simply change the emailadres there is no hijacking involved, everyone on the planet can sent you an email that has the emailadres of arenanet as the source. There is no skill at all involved to do so.

Bottom line, when checking for phisingmails, do not trust a message cause the senders mailadres looks valid and legit.

Thanks for the advice, I found out how to check the source IP, turns out it was an ISP in South Korea.

Glad I never check my emails, no phishing for me!
I was hacked near the start of the game and lost everything, from then on I go to My Account and Security to check what IP’s are on my account every now and then.

Originally when I was hacked I was online, and I was logged out, but nothing was taken.
Few weeks later I was online again, logged out, couldn’t get past the character selection screen because I was “logged in from another location”. Jumped on skype and my friends told me I was running between bank and BLT in divinities.
Only thing I could do was just keep changing servers on my account. Slowed the dude down but you can’t do that anymore.

So my advice, is never log out. Eat and sleep at your computer. And if you ever get logged out while playing, just straight onto My Account and Security to deny them.
Oh and my password is now a massive randomly generated code that hopefully China can’t crack.

Good luck!
(Because if they have your email, they know who you are, heh heh heh)

https://forum-en.gw2archive.eu/forum/game/gw2/Phishing-e-mail-going-around/first#post2075134

I just had this one come through:

Dear Players

This is the Guild Wars 2 team for further investigation be.

We appreciate that your account has been stolen concerned. To ensure the legitimacy of your account, click on the link below.
<link deleted>

Once your account is complete certification, we will check your account and let you know that we can do for you.

Need help or have questions about your account? Please visit our: https://support.guildwars2.com/.

The Guild Wars 2 Team

I received that same one this morning

Sib.1236:

I received that same one this morning

If I was an english teacher on the chinese school where these hackers studied English I would be very angry now (And I know my english isn’t perfect either)

I got it too. I just learned that there is a small country called “Palay” in the pacific ocean which has the top level domain *.pw. Thats one awesome ending for phishing urls. Kudos bad guys! Since the english is not the best there i hope that no one will fall for that trick.

This spam gets really annoying, can I add “support@guildwars2.com” to my spam filter or would this probably block some legit ArenaNet Emails too?

Here is a fake email I got. I’m posting it here in hope more people will see it and avoid getting scammed.

Dear Players

This is the Guild Wars 2 team for further investigation be.

_We found that there is a security risk to your account, click on the link below.

Once your account is complete certification, we will check your account. Once verified, you will receive in the near future in the game mailed mystery gift. If you do not complete the verification we will limit risk account or close the account

Need help or have questions about your account? Please visit our:

The Guild Wars 2 Team

This email came from “support@guildwars2.com” and is leading to

Do not visit that site, do not type in your account information

As you can see, it’s written in poor english.

Edit: links have been removed by the Mod team to prevent players from clicking them by mistake

obviously, links written didnt lead to those sites but to the one i mentioned below

bakalarko.4850:

obviously, links written didnt lead to those sites but to the one i mentioned below

You should probably remove those links since others might click them without reading your disclaimer and end up with problems.

It’s been on going for some time and there are already multiple threads about fake emails.

https://forum-en.gw2archive.eu/forum/support/account/Email-from-ArenaNet-Please-read

As JustTrogdor said, please remove the links from your post, you should never post links like that as it only endangers other users.

Got this email from " Guild Waes", no miss type;

Here is the mail, don’t click anything !

Dear Players

This is the Guild Wars 2 team for further investigation be.

We appreciate that your account has been stolen concerned. To ensure the legitimacy of your account, click on the link below.
https://account.guildwars2.com/account/login- support.html

Once your account is complete certification, we will check your account and let you know that we can do for you.

Need help or have questions about your account? Please visit our: https://support.guildwars2.com/.

The Guild Wars 2 Team

You can see all the spelling mistake and such, so please don’t fall this!!

With regards,

Primal

Hi Primal,

Although I appreciate your warning, I wonder why you make this thread. In the sticky is allready an official reesponse to thise Phising mails. Besides that a few lines lower you can find a merged thread (where this very likely ends in). Only bout an hour ago the support liason commented there. Arenanet is aware, the players are aware. No need to make yet another thread.

-edit: this response was written before a merge -

I keep getting these? [redacted link]

Gail; Today I recieved an e-mail from what appears to be Guild Wars 2 support however something does not feel right about it. All the included links refer to “de.support.guildwars2.com.account.verification.loing.entvasss.gulldwars2.pw/.” Yes that is “gulldwars2.” Would you like me to forward it to you with the header information in a seperate text?

Here is the part of the e-mail that set off alarms first: “Once your account is complete certification, we will check your account. Once verified, you will receive in the near future in the game mailed mystery gift. If you do not complete the verification we will limit risk account or close the account” There was no period at the end.

Ken /|\

I’ve just had one, you already have it in your list of known emails.
Would it not be wise to email players warning them of a new round of scams rather than relying on them maybe coming here to find out?
It actually reminded me I meant to set up the authenticator, so was actually useful but still, would have been nice to have had an email from anet warning of phishing.

General Health.9678:

I’ve just had one, you already have it in your list of known emails.
Would it not be wise to email players warning them of a new round of scams rather than relying on them maybe coming here to find out?
It actually reminded me I meant to set up the authenticator, so was actually useful but still, would have been nice to have had an email from anet warning of phishing.

I wouldnt mind getting an email from Arenanet warning bout these kind of scams. However not everytime there is a new one discovered. The simple reason is that I actually don’t recieve the phising mails.

Besides that, they are rather common, so it would mean a lot of emails from arenanet. People would start considering them as spam and ignore them anyway.

Hey, I got an unusual email that is by passing the /junk and marking it /safe.

Pretty sure its a fake email but I want to post it here showing that they are trying to improve the legitimacy of it.

Quote:

From: ArenaNet (noreply@guildwars2.net)
Sent: Fri 5/24/13 8:53 AM
To: (Removed)

Greetings!

It will be ongoing for further investigation by ArenaNet’s employees.

We are concerned about whether your account has been stolen. In order to guarantee the legitimacy of your account, click the link below.

//account.guildwars2.com/account/login-support. html

Once your account authentication has been completed, we will check your account and let you know what we can do for you.

Need help or have questions about your account? Visit our support site: //support.guildwars2.com/.

The Guild Wars 2 Team

Fake Bad Link Cover up:

//account.guildwars2.login.com.xe-ouf.asia/?loginservice=wam&ref=0&app=bam

Gaile Gray.6028:

Skuz.4856:

I figured as much, I was alarmed purely because they had somehow hijacked the official email address hence it showing up as on my safe list.

They didn’t highjack our email address. They are simply inputting it as the sender. Anyone can do that. I could send a mail as Robert E. Lee, Catherine the Great, or Captain Kirk. So could you. This is because the sender name is never verified against the sending address.

So as a savvy email user, don’t look at what it says but examine the email’s behind-the-scenes properties by doing a right-click and then reviewing “properties” on the popup. You’ll see who really sent the mail, and in these cases, it’s not us!

This, got a phishing e-mail yesterday to an e-mail that wasn’t even associated with gw2, thought that was pretty funny…but it holds true they are just sending out mass e-mails to everybody even if they don’t know if your playing gw2 or not.

And I did look at the properties, had some weird www address and looked up the ip it came from it was in Asia, so yeah, pretty easy to do to see where it came from….but, it did look kitten official

I never had this problem now i get like 20 e-mails from the same site a DAY! and the are bypassing the normal spam-filter. How can i block this ?

How you block it depends on your email provider. If it has half decent filters you should be able to create a filter to block emails containing “it will be ongoing for further investigation”. Then if the email text changes, create another filter.

If your email provider doesn’t have filters, get another provider. :p

Gaile Gray.6028:

Kendra Nightwind.8734:

Gail; Today I recieved an e-mail from what appears to be Guild Wars 2 support however something does not feel right about it. All the included links refer to “de.support.guildwars2.com.account.verification.loing.entvasss.gulldwars2.pw/.” Yes that is “gulldwars2.” Would you like me to forward it to you with the header information in a seperate text?

Here is the part of the e-mail that set off alarms first: “Once your account is complete certification, we will check your account. Once verified, you will receive in the near future in the game mailed mystery gift. If you do not complete the verification we will limit risk account or close the account” There was no period at the end.

Ken /|\

Of course that’s a fake. Note misspelling. Note horrible grammer. And the process makes no sense. Delete and ignore. Do NOT click links. And no, thanks, I don’t need to see the header information, although if you want to copy (without clicking links) the full body of the email and provide it here, I can add it to my phishing archives. Please do NOT include the links in the copy, if you do paste it here.

Here you go:
Dear Players

This is the Guild Wars 2 team for further investigation be.

We found that there is a security risk to your account, click on the link below.
account.guildwars2.com/account/login- support.html

Once your account is complete certification, we will check your account. Once verified, you will receive in the near future in the game mailed mystery gift. If you do not complete the verification we will limit risk account or close the account

Need help or have questions about your account? Please visit our: support.guildwars2.com/.

The Guild Wars 2 Team

As per your request the links have been disabled.

I just got a random e-mail that claimed to be from “Guild Waes Support” (sic). I did not open it, but I thought I would warn others to be on the look-out. These folks are always trying to steal/hack accounts, so be careful…even of the ones that can’t spell.

Aliro.6071:

I just got a random e-mail that claimed to be from “Guild Waes Support” (sic). I did not open it, but I thought I would warn others to be on the look-out. These folks are always trying to steal/hack accounts, so be careful…even of the ones that can’t spell.

Thank you for your warning. This warning however is cluttering this forum section up. The general warning is here: https://forum-en.gw2archive.eu/forum/support/account/A-Note-about-Phishing-Emails-1

To add this one to the list please reply to this thread: https://forum-en.gw2archive.eu/forum/support/account/Email-from-ArenaNet-Please-read/page/8#post2092235

And another one… on first sight a good attempt, didn’t find any misspelling, and all the links seem to be “normal”

Just thought I’d inform of a New Phishing scam email that’s about That I got this morning. It had the GW2 Logo Looked rather legit however It tried to state due to a payment not going thru that my account was getting Shut down. It also states in this email that you get a 72 hour ban. didn’t make sense but like most of these emails ( I’ve seem plenty from WoW gaming) I didn’t click no links but the link they had when hoovered had .tk at the end.

This email is plenty to put fear not just in your account closing, banned for nothing but Credit card users may wanna be aware also.

I know from reading over forums you guys don’t have a hacks or abuse section to report headers of these such emails but its prolly an Idea to consider it will end up a monster later on.

https://forum-en.gw2archive.eu/forum/support/account/Email-from-ArenaNet-Please-read/page/8#post2100683

okay so lately ive been getting a bunch of emails, click this, verify that, bla bla, but under “My Stuff” on this website, it says exactly that and i am wondering WHERE this is coming from,

now like i said this is under my guild wars 2 account support and it has that exact email. you guys get hacked into or something? Here is the FULL email i received many, many times.

Greetings!

It will be
ongoing for further investigation by ArenaNet’s
employees.

We are
concerned about whether your account has been stolen. In
order to guarantee the legitimacy of your account, click
the link below.
< I deleted it>

Once your
account authentication has been completed, we will check
your account and let you know what we can do for
you.

Need help or
have questions about your account? Visit our support
site:
<omnomberries!>

The Guild
Wars 2 Team