Guild Wars 2

Tjah Jadi.7914:

Hi Gaile,

Isn’t there a way to block these fishing emails?
I’m getting these emails like once a day on my old, and new email adress which I both have used for Guild Wars. And a lot of different ones as well.

It would be great if I can block these emails!

Can you help me?

TjahJadi

(although im not Gaile) Yes you can; get a spam filter.

The problem is that the sender of the email shouldn’t be blocked. The ip adres is just ripped off from someone who was hacked so thats no use either. The only way to filter it is the text. A spam filter is updated regularly to filter on the text.

Just to add. Many email-providers have a built in spamfilter. Maybe it is a good plan to share the mailprovider you are using. I’m personally using gmail. I had these kind of emails twice so far. I do believe that gmail has good way of blocking most of them, simply cause i did recieve them, but im not being bombarded daily.

So I thought it was the funniest thing when the other day upon checking my email and finding one that was suppose to be from Guild Wars 2 support (or whatever), but upon opening it its content referenced nothing but Diablo 3.

I don’t have a sample as I just report/delete them, but for obvious reasons that one should be obvious to anyone.

Hello,

I have also received an e-mail from a scam website.

Website provided by scam link:
[LINK REDACTED]

As attachment a screenshot of the mail.

Greetings Jeronetj3

Is this legitimate?

Guild Wars Account Will Be Shut Down Inform

“We are sorry to inform you that your login account will be shut down or partially limited within 72 hours due to currency transactions or abnormal login. If you want to remove restrictions, please click the following link to validate::
https://forum.guildwars.com/login

We will come up with certain security protection measure to protect this account.If your account is limited due to our negligence, we will remove the restriction on our end and offer you a mysterious gift in game as compensation for the inconvenience."

The Guild

Cryshal.4036:

Is this legitimate?

Guild Wars Account Will Be Shut Down Inform

“We are sorry to inform you that your login account will be shut down or partially limited within 72 hours due to currency transactions or abnormal login. If you want to remove restrictions, please click the following link to validate::
https://forum.guildwars.com/login

We will come up with certain security protection measure to protect this account.If your account is limited due to our negligence, we will remove the restriction on our end and offer you a mysterious gift in game as compensation for the inconvenience."

The Guild

No, it’s a scam. There have been a lot of them lately.

https://forum-en.gw2archive.eu/forum/support/account/Email-from-ArenaNet-Please-read

Not sure if this is a scam or not… I did not click the link.
[LINK REDACTED]

Hi, I’ve recently bought GW2 about a week ago, and I’ve been playing it for about a few hours, and I’ve created 2 characters in my account on the same homeworld, everything was going well until today when I received an email notice with the title “Account Abuse” from noreply@guildwars2.com. I believe I haven’t breaking any rules or done anything against the policy, but here’s what it said:

"""Greetings!

It will be ongoing for further investigation by ArenaNet’s employees.

If you wish to not get your account suspended you should immediately verify your account ownership. You must complete the steps below to secure the account and your computer.

STEP 1: ACCOUNT INVESTIGATION

We now provide a secure website for you to verify that you have taken the appropriate steps to secure the account, your computer, and your email address. Please go to this site and follow the instructions:
[LINK REDACTED]

STEP 2: VERIFY YOUR SUBMISSION WAS RECEIVED

We will contact you with further instructions once we have received and processed your submission. If you do not receive a reply within 48 hours of submitting this form, please resend it from the address listed above.

If you ignore this mail your account can and will be closed permanently.

—The ArenaNet Team"""

and heres the link to the picture, its a photobucket direct link to the image: [LINK REDACTED]

Got the same email as above, copied some of it here:

Guild Wars Account Will Be Shut Down Inform

“We are sorry to inform you that your login account will be shut down or partially limited within 72 hours due to currency transactions or abnormal login. If you want to remove restrictions, please click the following link to validate::
___________________________________

They failed to give themselves credibility based on the reasons they specify my account would be adversely affected:

1. no one but me knows my account logon
2. I never have that much gold or whatever, to raise an eyebrow.

I got this one too. Was it phishing me? If so, I responded and it took me to what seemed like official Guild wars account stuff. What should I do? I can change my password immediately, I guess. I also added the phone authentication to it. Since I can’t change my email address or my serial code, are there any other steps I can take to avoid what this Phishing attempt my try?

I have received an email from “ArenaNet” and it is asking me to follow this link: https://account.guildwars2.com/account/login-support.html i need to know if this is from a phishing email
any help would be appreciated

I have got following email today. I suppose its phising one. Just to warn other players. Be careful.

Subject: Guild Wars Account Will Be Shut Down Inform
From: ArenaNet

Guild Wars Account Will Be Shut Down Inform

We are sorry to inform you that your login account will be shut down or partially limited within 72 hours due to currency transactions or abnormal login. If you want to remove restrictions, please click the following link to validate:: https://forum.guildwars.com/login

We will come up with certain security protection measure to protect this account.If your account is limited due to our negligence, we will remove the restriction on our end and offer you a mysterious gift in game as compensation for the inconvenience.

The Guild Wars 2 Team

yes I got this too.

It was placed in my junk mail so very suspicious.

Also appears on the pishing e-mail sticky above

irrelephant post due to move

Hello,

I got this Email yesterday, wondering if this fishy or not? The Email is from noreply@guildwars2.com

“Guild Wars 2 – Account Abuse

Greetings!

It will be ongoing for further investigation by ArenaNet’s employees.

If you wish to not get your account suspended you should immediately verify your account ownership. You must complete the steps below to secure the account and your computer.

STEP 1: ACCOUNT INVESTIGATION

We now provide a secure website for you to verify that you have taken the appropriate steps to secure the account, your computer, and your email address. Please go to this site and follow the instructions:
{Link in Email}

STEP 2: VERIFY YOUR SUBMISSION WAS RECEIVED

We will contact you with further instructions once we have received and processed your submission. If you do not receive a reply within 48 hours of submitting this form, please resend it from the address listed above.

If you ignore this mail your account can and will be closed permanently.

—The ArenaNet Team"

Thank you
Aus

I wonder if a verification code on Anet emails is possible and have a Anet email verifier on the main site?

Fraud is becoming a huge issue worldwide

xxmblade.3056:

I have received an email from “ArenaNet” and it is asking me to follow this link: https://account.guildwars2.com/account/login-support.html i need to know if this is from a phishing email
any help would be appreciated

I can virtually guarantee if you hover your mouse over the link (without clicking it), what you see in the tooltip will be totally different! That gives you a big clue this is a phishing email. For one it probably doesn’t even start with https:// and there are probably extensions after the guildwars2.com like guildwars2.com.XXX.YYY

Just got a phishing email on the 26th of June that you might like to know about Here is a link to a picture of the email (With the location the URL link will take you to, visible) as well as a copy of the email Header/Source provided below (Unsure how to use quote tags on this forum)

http://i63.photobucket.com/albums/h133/franpa/Untitled_zpseae4e892.png~original

x-store-info:4r51+eLowCe79NzwdU2kR3P+ctWZsO+J
Authentication-Results: hotmail.com; spf=none (sender IP is 58.240.20.107) smtp.mailfrom=wziwex@WWW-9763E06E580.org; dkim=none header.d=guildwars2.com; x-hmca=none header.id=noreply@guildwars2.com
X-SID-PRA: noreply@guildwars2.com
X-AUTH-Result: NONE
X-SID-Result: NONE
X-Message-Status: n:n
X-Message-Delivery: Vj0xLjE7dXM9MDtsPTA7YT0wO0Q9MjtHRD0yO1NDTD02
X-Message-Info: 11chDOWqoTmjqhOzvWWhowbhFoTp9MJYyx1KRO401xisOjcKuGmA1UUWXM5YZZkHl95XrANeTvMpSWxJNfWMAfa/uFlwOzw+Ejqg7ydZTJaFd0Pf3qH54/3+Y8sOCxhGVbzj4jzFb7LlkITsBpOqS0H4iNftZ1fSQtR6cPycaMg=
Received: from WWW-9763E06E580.org ([58.240.20.107]) by SNT0-MC4-F32.Snt0.hotmail.com with Microsoft SMTPSVC;
Tue, 25 Jun 2013 10:42:42 -0700
Message-ID: <FFA0FDE23EF9ACEEDBB85FAA3E78C439@WWW-9763E06E580.org>
From: “ArenaNet” <noreply@guildwars2.com>
To: <change_for_security_reasons_duh@example.com>
Subject: Guild Wars 2 – Account Abuse
Date: Wed, 26 Jun 2013 01:42:26 +0800
MIME-Version: 1.0
Content-Type: text/html;
charset=“utf-8”
Content-Transfer-Encoding: base64
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2900.5512
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.5512
Return-Path: wziwex@WWW-9763E06E580.org
X-OriginalArrivalTime: 25 Jun 2013 17:42:43.0175 (UTC) FILETIME=[65469F70:01CE71CB]

I’d compare what you got in the sticky thread in this forum about phishing emails – if it’s new, add it in the list.

Ah okay, seems like they’re already aware of it then. Thanks, I didn’t notice the sticky.

I just got one of these e-mails myself and to aid the guys/girls at GW i have decoded the header for you.

Header If its form

x-store-info:qAUQJzZ73IJCLUJ+0n7ZQ0tyh3aLbvsRGm3bfjfOypLENkkWLOmrlK9dn1IUgzodabvd9iOvsJffWpHaZRU4k3W0UkvtFNskaTMlmZoSoEIWykQpljCJBRkqjr33k31LaWbT9R+G7pA=
Authentication-Results: hotmail.com; spf=none (sender IP is 220.231.188.82) smtp.mailfrom=gy@WWW-9763E06E580.org; dkim=none header.d=guildwars2.com; x-hmca=none header.id=noreply@guildwars2.com
X-SID-PRA: noreply@guildwars2.com
X-AUTH-Result: NONE
X-SID-Result: NONE
X-Message-Status: n:n
X-Message-Delivery: Vj0xLjE7dXM9MDtsPTA7YT0wO0Q9MztHRD0zO1NDTD02
X-Message-Info: 6YO/4nwP5t3FuUJkWugtSn3ohwZ6tAFHt71xK8xpG2lasF+CTLdRcGgZHFcuKVK6Zpe2npRMWUZAsvgIlUvDzw8+Ok6cJam7yRzljgHaz85b00EJz6+GdrMvJ7A843a9wP4zh+kLqyoSWOxhf0HrehwK7FLCdEaJ/QVocEK/iUM=
Received: from WWW-9763E06E580.org ([220.231.188.82]) by COL0-MC1-F20.Col0.hotmail.com with Microsoft SMTPSVC; Sat, 29 Jun 2013 15:32:06 -0700
Message-ID: <67F637AA18B3587B2D5C14C668951528@WWW-9763E06E580.org>
From: \“ArenaNet\” <noreply@guildwars2.com>
To: <xxxxxxxxx@live.com> (Blanked for a Reason)
Subject: Guild Wars 2 – Account Abuse
Date: Sun, 30 Jun 2013 06:32:09 +0800
MIME-Version: 1.0
Content-Type: text/html; charset=\“utf-8\”
Content-Transfer-Encoding: base64
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2900.5512
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.5512
Return-Path: gy@WWW-9763E06E580.org
X-OriginalArrivalTime: 29 Jun 2013 22:32:07.0054 (UTC) FILETIME=[7C9B4AE0:01CE7518]

Decoded Information

The source IP address is 220.231.188.82.
Country China
State/Region 30
City Shenzhen
Latitude 22.5333
Longitude 114.1333

What is scary the whole e-mail is base64 encrypted but lucky i have decrypted it for you. This Paste bin link is safe.

http://pastebin.com/xdGHqpYg

WARNING! Do not copy the link from the pastebin file to your browser and run it. Its a Phishing E-mail designed to steal your information i am only posting this to aid other users of this community.

It also aid the GW Mods/Teams to track down and hopefully get that site blocked.

The phishing scams are getting better and better so we need to be one step in front.

Trying to get phishing sites shut down is, for the most part, a complete waste of time. They pop up like roaches. There are likely a lot of these sites sitting around waiting to be used.

I used to work for a company that would get a lot of phishing emails and instant messages. They were sent to the employees in an attempt to get employee credentials. The sites that these emails and messages pointed to would pop up left and right because it was just a matter of taking the same web host files and putting them on a different server. That can be done in minutes. Blocking the web sites accomplished nothing.

Guild Wars Account Will Be Shut Down Inform

We are sorry to inform you that your login account will be shut down or partially limited within 72 hours due to currency transactions or abnormal login. If you want to remove restrictions, please click the following link to validate::

We will come up with certain security protection measure to protect this account.If your account is limited due to our negligence, we will remove the restriction on our end and offer you a mysterious gift in game as compensation for the inconvenience.

The Guild Wars 2 Team

I had this one today I did not see it on list here:- https://forum-en.gw2archive.eu/forum/support/account/A-Note-about-Phishing-Emails-1/first#post2174278

This one came through today:

Greetings!

It will be ongoing for further investigation by ArenaNet’s employees.

If you wish to not get your account suspended you should immediately verify your account ownership. You must complete the steps below to secure the account and your computer.

STEP 1: ACCOUNT INVESTIGATION

We now provide a secure website for you to verify that you have taken the appropriate steps to secure the account, your computer, and your email address. Please go to this site and follow the instructions:
Suspect link was here

STEP 2: VERIFY YOUR SUBMISSION WAS RECEIVED

We will contact you with further instructions once we have received and processed your submission. If you do not receive a reply within 48 hours of submitting this form, please resend it from the address listed above.

If you ignore this mail your account can and will be closed permanently.

—The ArenaNet Team

i also got this email yesterday and noticed it in the junk mail,(i have taken out the links in the email)
is it from Arena net or hackers?

Greetings!

It will be ongoing for further investigation by ArenaNet’s employees.

If you wish to not get your account suspended you should immediately verify your account ownership. You must complete the steps below to secure the account and your computer.

STEP 1: ACCOUNT INVESTIGATION

We now provide a secure website for you to verify that you have taken the appropriate steps to secure the account, your computer, and your email address. Please go to this site and follow the instructions:

STEP 2: VERIFY YOUR SUBMISSION WAS RECEIVED

We will contact you with further instructions once we have received and processed your submission. If you do not receive a reply within 48 hours of submitting this form, please resend it from the address listed above.

If you ignore this mail your account can and will be closed permanently.

—The ArenaNet Team

The only time I started to get these emails was when I signed up for the Diablo 3 beta. The emails where about my battlenet account. Now when i bought gw2 and created the account here, the emails have changed to the emails most people are receiving. I’m just curious to what battlenet and arenanet do with our email addresses. Is this coincidence that I happen to make either of these accounts and have these spam emails follow?

Dinkie Dow.5147:

The only time I started to get these emails was when I signed up for the Diablo 3 beta. The emails where about my battlenet account. Now when i bought gw2 and created the account here, the emails have changed to the emails most people are receiving. I’m just curious to what battlenet and arenanet do with our email addresses. Is this coincidence that I happen to make either of these accounts and have these spam emails follow?

I have a battlenet account (and I had D3 and Pandaria beta access), and an arenanet account using the same email address. I’ve never had a single one of these phishing mails. So yes, I’d say it’s a coincidence.

For a while now I’ve been getting emails that say my account has been stolen/hacked. The emails come from this email address, noreply@guildwars.com. It says

Greetings!

It will be ongoing for further investigation by ArenaNet’s employees.

We are concerned about whether your account has been stolen. In order to guarantee the legitimacy of your account, click the link below.
[LINK REDACTED]

Once your account authentication has been completed, we will check your account and let you know what we can do for you.

[i]Need help or have questions about your account? Visit our support site:
[LINK REDACTED]

The Guild Wars 2 Team

When I click the link that would check the legitimacy of my account my anti virus blocks the site for reported web forgery.

This is what the anti virus says

This web page at [LINK REDACTED] has been reported as a web forgery and has been blocked based on your security preferences.

I noticed that, that link is kinda sketchy and different to the one that was in the email.

Recently I got an email from noreply@guildwars2.com that says

Greetings!

It will be ongoing for further investigation by ArenaNet’s employees.

If you wish to not get your account suspended you should immediately verify your account ownership. You must complete the steps below to secure the account and your computer.

STEP 1: ACCOUNT INVESTIGATION

We now provide a secure website for you to verify that you have taken the appropriate steps to secure the account, your computer, and your email address. Please go to this site and follow the instructions:

[LINK REDACTED]

STEP 2: VERIFY YOUR SUBMISSION WAS RECEIVED

We will contact you with further instructions once we have received and processed your submission. If you do not receive a reply within 48 hours of submitting this form, please resend it from the address listed above.

If you ignore this mail your account can and will be closed permanently.

—The ArenaNet Team

When I click the link in this email the page doesn’t load and nothing happens, so I am posting here to maybe get some help to see if these are real emails and what I should do

Those emails are fake, there are multiple threads about them as well as a sticky at the top.
https://forum-en.gw2archive.eu/forum/support/account/A-Note-about-Phishing-Emails-1

Please remove those links from your post above as they pose a danger to other players. If you have clicked on any of the links, you should change your password at once to avoid having your account stolen.

Found those phishing email on old e-mail account spam folder(which I used to associate GW2 with). The detail are just like everyone else’s email.Those mail sent around June 18th

Is this email legit? See link or attached picture for screen dump:
http://i.imgur.com/9aQgKnD.jpg

Is this email legit? See link or attached picture for screen dump:
http://i.imgur.com/9aQgKnD.jpg

No it’s not. Anet will never send out emails about account status. They will only respond to support tickets that you have submitted.

https://forum-en.gw2archive.eu/forum/support/account/A-Note-about-Phishing-Emails-1

Hi , i just got this email there is somethnink that i must do or ignore it ?(is it normal)

“Greetings!

It will be ongoing for further investigation by ArenaNet’s employees.

If you wish to not get your account suspended you should immediately verify your account ownership. You must complete the steps below to secure the account and your computer.

STEP 1: ACCOUNT INVESTIGATION

We now provide a secure website for you to verify that you have taken the appropriate steps to secure the account, your computer, and your email address. Please go to this site and follow the instructions:

STEP 2: VERIFY YOUR SUBMISSION WAS RECEIVED

We will contact you with further instructions once we have received and processed your submission. If you do not receive a reply within 48 hours of submitting this form, please resend it from the address listed above.

If you ignore this mail your account can and will be closed permanently.

—The ArenaNet Team"

This is a phishing email. DONT CLICK ON THAT LINK!

Also, you should remove the link so no one else clicks on it.

ANet doesn’t send people emails like that. If there is a problem they shut down the account and wait for you to contact them.

ok i remove link ! ! !

thank you very much ! ! !

I wanted to know I this was legit, I’m not on my computer so I found this email strange. If anyone from support can get back to me that would be greatly appreciated!

Here is the email from the following email address :
noreply@guildwars2.com

Guild Wars Account Will Be Shut Down Inform

We are sorry to inform you that your login account will be shut down or partially limited within 72 hours due to currency transactions or abnormal login. If you want to remove restrictions, please click the following link to validate::
(suspicious link was here)

We will come up with certain security protection measure to protect this account.If your account is limited due to our negligence, we will remove the restriction on our end and offer you a mysterious gift in game as compensation for the inconvenience.

The Guild Wars 2 Team

If this is true, can someone from support point me in the right direction.

Fake.
If Anet needs to close an account, they just go ahead and do so, giving you the option to simply open a ticket with customer support to resolve the issue.

yes, its a phishing scam, ill remove the link address since i don’t want anyone going to that site!

Guild Wars Account Will Be Shut Down Inform

This alone should tell you it’s not legit….

This IS an indication that a hacker knows your log in email address, so you might consider changing the email on your account. If you responded in any way, they now know it’s a legit log in name. From that info, they can attempt to burte force your password, so I suggest changing that immediately (and make it at LEAST 10 characters long).

Yes , I made sure to change my password, this is frustrating, but I’m glad the community was able to give helpful tips, much appreciated!

I just fell for one because it came in my actual inbox.

I’m screwed because I gave them all my information

I feel so stupid and bad right now.

I don’t know what to do.

Gaile Gray.6028:

Thoraxes.1948:

I just fell for one because it came in my actual inbox.

I’m screwed because I gave them all my information

I feel so stupid and bad right now.

I don’t know what to do.

Immediately contact Support by filing a ticket through the “Ask a Question” tab on that linked page. They probably will be able to assist you. For tips on what information to provide in a ticket — mostly intended for security reasons to establish that you own the account — please read this post and provide as many suggested details as possible to expedite the ticket.

Thank you! I will be sending an message through support asap now that i’ve gotten home from work.

I also received a fishy looking email last night, but it was a dead giveaway with the link when hovered on.