Guild Wars 2

Gaile Gray.6028:

AND… we don’t write using such awful grammar making a bunch of spelling errors.

But you guys do seem to insert the word “kitten” into the weirdest places of a sentence. Sometimes inside other words!

DO NOT USE ANY OF THE LINKS IN THIS REPLY

I also got a phishing E-Mail today. When I received the E-Mail I first looked for the common images ArenaNet uses in their E-Mails (logo, quaggans, etc…), as you can see there aren’t any. It appears as if the E-Mail is actually real, I almost fell for it, but the strangest thing about the E-Mail is that it went into the spam inbox, which is odd, as I have ArenaNet marked as VIP on my phone (it goes to a separate inbox), and most other E-Mails I get from ArenaNet go straight to junk if they are not about my account. interestingly enough, G-Mail seems to be able to tell if it’s a bogus E-Mail thanks to reports from other users, it didn’t actually let me click the link in the E-Mail. Next, I un-blocked it and proceeded to check the hidden link, it gave me the following link:

http://account.guildwars.com.40a37-34ea66-4addee-b38ec-f3116adce4f1.tk/

Notice the .tk at the end of the link. The .tk is the real domain system in the address, not the .com you can see before, notice there is also no forward slashes after the .com, .tk are usually for free domain names.

Also, after seeing the link, I took the link and ran it on my phone’s browser, and fair enough it did show a believable website layout, so I proceeded to enter bogus information, at the serial number for example I wrote “123456789”, which is more than unlikely to be an actual serial number, in combination with fake E-Mails and password. surely, the website did in fact accept it, and then took me to a login website (which seems to be GuidWars 2’s website apparently…). If you entered fake/incorrect information, you should get an error asking to contact support.

While it seems these phishing E-Mails are more and more thought-out, there’s always going to be a clue that will -at least- make you suspicious. I also think that -IF ArenaNet wanted to block your account, it would alert you in other ways, such as in-game mail or messages and perhaps other ways too. -IF- you DO want to see the link for yourself grab your mobile device (these are essentially malware-free even if the link DOES have malware) and enter there, and DO NOT enter ANY valid information (no E-Mail, no password, no serial # (use something like “123456789” or even “10”)).

Check the attachments for images of the actual E-Mail and the way the website is supposed to handle invalid information.

TIP: If you want to post a link BUT don’t want it to be clickable, just mark it as a code by using

[pre]

OK, I’m just gonna say it. I fell for this. Saw it in my spam folder and boom. I never get scammed and yet there it is.

So now what do I do? I changed my email and password. and all passwords similar across different accounts. No credit card was linked to it. Am I safe?

Got this email today

Greetings!

It will be ongoing for further investigation by ArenaNet’s employees.

If you wish to not get your account suspended you should immediately verify your account ownership. You must complete the steps below to secure the account and your computer.

STEP 1: ACCOUNT INVESTIGATION

We now provide a secure website for you to verify that you have taken the appropriate steps to secure the account, your computer, and your email address. Please go to this site and follow the instructions:
(link to site deleted)

STEP 2: VERIFY YOUR SUBMISSION WAS RECEIVED

We will contact you with further instructions once we have received and processed your submission. If you do not receive a reply within 48 hours of submitting this form, please resend it from the address listed above.

If you ignore this mail your account can and will be closed permanently.

—The ArenaNet Team

First time in a long time I got a phising email. So beware, don’t fall for it.

I got one of these to. I only started an account recently and now I receive this email. This is either a coincidence, or arenanet have a data leak. I’m betting it’s a leak, it usually is in this situations :/

Nasher.6874:

I got one of these to. I only started an account recently and now I receive this email. This is either a coincidence, or arenanet have a data leak. I’m betting it’s a leak, it usually is in this situations :/

People get these identical mails purporting to be from Blizzard. People get both that don’t even HAVE an account with Blizzard or ArenaNet.

I get spam emails spoofing my mother’s email that say “sent from my iPhone”. You might say that’s a data leak from Apple, but neither my mother nor myself own a single Apple product, let alone have iPhones.

Nasher.6874:

I got one of these to. I only started an account recently and now I receive this email. This is either a coincidence, or arenanet have a data leak. I’m betting it’s a leak, it usually is in this situations :/

Actually, no it’s usually not a leak, unless massive email lists floating around the Internet for years is what you’d consider a leak. Your email address is floating around in one or more mailing lists possessed by spammers and probably available for download or exchange. Once it gets on a spam list, you will likely get spam forever at that address. Your email address has probably been available in those lists for a long time, long before you registered for GW2.

I have used several hundred email addresses the past several years, and I get a lot of spam. I do mean a lot. A lot of it goes to addresses that I used for sites that are no longer around. Some of it goes to email addresses I have never used, ever, anywhere.

Sign up for enough services and you’ll start to see patterns re: where the spam comes from. ArenaNet isn’t to blame.

LPHeadstrong.6798:

OK, I’m just gonna say it. I fell for this. Saw it in my spam folder and boom. I never get scammed and yet there it is.

So now what do I do? I changed my email and password. and all passwords similar across different accounts. No credit card was linked to it. Am I safe?

Contact Arenanet and tell them your account might be compromised? Also run virus checkers just in case?

Guild Wars 2 Account Will Be Shut Down Inform

We are sorry to inform you that your login account will be shut down or partially limited within 72 hours due to currency transactions or abnormal login. If you want to remove restrictions, please click the following link to validate:
https://linkremoved.com

Recently, account abuse is obviously rising up. Please pay attention to the safety your account. Don’t share account with any other people. We will not ask for your email password in any forms on our end. With the password, hackers will be able to log in the account through our security verification. If you have any account problem, please click on the link below:
https://linkremoved.com
Need help or have questions about your account? Please visit our: https://linkremoved.com

The Guild Wars 2 Team

This mail has the spoof emial address of noreply@guildwars2.com as well

may be legit but then again i dont think so but just incase have gone in via arena net site and changed my password not followed the links

If you hover the link, you should see to what website the link is going.
If you see weird names in it, then yes it is a spam email.

lol i just figured out that gw1 didnt had a forum feels good that my mind was still aware of that somehow :>

That has been going on for a very long time. Please see the thread below.

https://forum-en.gw2archive.eu/forum/support/account/Email-from-ArenaNet-Please-read-merged

People need to learn to read the forums before posting. Gaile needs to keep merging these duplicate threads.

haven’t played GW2 for over 3 months got one of this emails as well ( like Kirkman.1936 email ) i was like oh god what know.

good thing i dint click on it and search and noticed this thread, hate this people…

Greetings!

It will be ongoing for further investigation by ArenaNet’s employees.

If you wish to not get your account suspended you should immediately verify your account ownership. You must complete the steps below to secure the account and your computer.

STEP 1: ACCOUNT INVESTIGATION

We now provide a secure website for you to verify that you have taken the appropriate steps to secure the account, your computer, and your email address. Please go to this site and follow the instructions:
https://account.guildwars2.com/account/login-support.html

STEP 2: VERIFY YOUR SUBMISSION WAS RECEIVED

We will contact you with further instructions once we have received and processed your submission. If you do not receive a reply within 48 hours of submitting this form, please resend it from the address listed above.

If you ignore this mail your account can and will be closed permanently.

—The ArenaNet Team

it’s true? or it’s a pishing?

Yes it’s phising

Seriously i have no mercy for these guys.. none what so ever. Just saying if it whas legal i would so… well lets say i would hunt them down.
This is from the original header by the way.

Delivered-To: my mail adres.com
Received: by 10.204.12.205 with SMTP id y13csp180952bky;
Sat, 22 Jun 2013 07:45:27 -0700 (PDT)
X-Received: by 10.224.149.199 with SMTP id u7mr19046744qav.37.1371912326790;
Sat, 22 Jun 2013 07:45:26 -0700 (PDT)
Return-Path: <rlxrrbec@kqjswmca.com>
Received: from kqjswmca.com ([211.190.129.120])
by mx.google.com with ESMTP id q4si4583718qag.144.2013.06.22.07.45.23
for <my mail adres again .com>;
Sat, 22 Jun 2013 07:45:26 -0700 (PDT)
Received-SPF: neutral (google.com: 211.190.129.120 is neither permitted nor denied by best guess record for domain of rlxrrbec@kqjswmca.com) client-ip=211.190.129.120;
Authentication-Results: mx.google.com;
spf=neutral (google.com: 211.190.129.120 is neither permitted nor denied by best guess record for domain of rlxrrbec@kqjswmca.com) smtp.mail=rlxrrbec@kqjswmca.com
Message-ID: <2F45EDC1F33FE94407D07D853AA18459@kqjswmca.com>
From: “ArenaNet” <support@guildwars2.com>
To: <my mail adres, hello again.com>

calerouxz.2684:

Snip

I can confirm getting this smae email. Outlook informed me it might be a phishing email, disabled the mails functionality, had the same link stream as mentioned in Calerouxz’s. Initially reaction was to log onto the actual site and check for anything via login attempts or in-game for any gem store purchases seeing none were the case…and now reading the email their are some grammatical errors, either way it’s another email to be wary of.

if you get fake sites with .tk, send a mail to abuse@dot.tk with the source email code in it, and they will block the site.

lots of other registrars do this as well.
If its chinees or east europian, do not bother to send mail to the abuse address.

Hi Folks

Just been on my email and got a rather odd request from ArenaNet to reset my Security Question. I know I didn’t ask for a reset and after hovering over the link it looked a bit phishy.

Can anyone verify if it’s a scam mail for me?

Many Thanks

AzReF.6912:

Hi Folks

Just been on my email and got a rather odd request from ArenaNet to reset my Security Question. I know I didn’t ask for a reset and after hovering over the link it looked a bit phishy.

Can anyone verify if it’s a scam mail for me?

Many Thanks

It’s a scam mail. They are trying to steal your account.

ANet does not contact you first. And the reason they don’t is emails like that one. It would be too easy then to confuse a contact email from them with a thief’s email. If there is reason, they suspend/ban the account and then wait for the account holder to contact them to try to resolve it.

I have started to receive emails titled

“Guild Wars 2 Account Be Shut Down Inform”

Purporting to come from “ArenaNet (noreply@guildwars2.com)”

There were two reasons these emails made me suspicious

1.. The bad use of the English language and a sentence structuring that can only have come from a non English speaking native that had been translated by babelfish

2.. These emails were sent to an email address of mine that I do not use with GW2

here is the content of the email with the outside links disabled

“We are sorry to inform you that your login account will be shut down or partially limited within 72 hours due to currency transactions or abnormal login. If you want to remove restrictions, please click the following link to validate:
h t t p s://account.guildwars2.com/AccountVerification/login?

Recently, account abuse is obviously rising up. Please pay attention to the safety your account. Don’t share account with any other people. We will not ask for your email password in any forms on our end. With the password, hackers will be able to log in the account through our security verification. If you have any account problem, please click on the link below:

Need help or have questions about your account? Please visit our:
h t t p s://support.guildwars2.com/.

The Guild Wars 2 Team"

By hovering (I did Not click the link on) the mouse over the a"AccountVerification" link this address appeared at the bottom of the screen

“accouint.verificcatioon.login.45a02a-37d-3466-4ddee-b38c-f316adce4f1 and ended with .tk/guildwars2-support

as you can see clearly the “.tk” tells us that this link is the Internet country code top-level domain (ccTLD) for Tokelau, a territory of New Zealand located in the South Pacific and not Guild Wars in America or Europe

My Advice to you all is if you should get an email from Guild Wars then do NOT click any links given in the email instead, go to the GW2 website using one of your bookmarks or googling GW2

It’s a know issue, but thanks again for the warning.

Re: My post just above

To the Admins, one should not look at this as a bad thing so much as an opportunity

If Arena net was to set up a few fake accounts and then login at that phishing site one could watch as they access the game and follow what they do. They may use a proxy to access the game. They may not. but you would actually see if they had friends online who were working with them. I personally would do this as the infiltration could clean out a whole network.

I believe the 194th rule of acquisition would be applicable here “It’s always good to know about new customers before they walk in your door”

Not sure if this has been mentioned but but it’s worth pointing out regardless.

Never ever use the links contained in an email. Always navigate to the website from the browser so you’ll know that you’re on the real website.

If you go to these websites, also be aware they likely have cookies that track you. Some of these cannot be deleted easily.

They sure went to extreme to think you are on a gw site. Well ok if your not a complete idiot of course.:

http://account.guildwars2.com.4550aaa-e137d-3466-4ddee-b38c-f316a-dce4f1.tk/login.html

Why is it always these chinese that try to ruin games for people.

aspirine.6852:

They sure went to extreme to think you are on a gw site. Well ok if your not a complete idiot of course.:

Why is it always these chinese that try to ruin games for people.

Actually the link leads to Tokalau an island belonging to New Zealand the .tk in the link is the teller

Guild Wars Account Will Be Shut Down Inform

We are sorry to inform you that your login account will be shut down or partially limited within 72 hours due to currency transactions or abnormal login. If you want to remove restrictions, please click the following link to validate::
https://account.guildwars2.com/login

The Guild Wars 2 Team

Once in a while i get this message, what that means? I login 5-8 time per day, is it normal? what i should do?

it’s a phishing e-mail. Please don’t click those links. They lead to fake sites designed to steal your account. There’s a stickied thread about the e-mails already in this forum.

https://forum-en.gw2archive.eu/forum/support/account/A-Note-about-Phishing-Emails-1/first#post2535375 Here’s the thread.

i’ve already click on the link, what happens now?

You’re going to want to change your email and password immediately. Start with the password, and then submit a ticket to Support for help changing your email. Best of luck to you.

the massage already appear weeks ago, and also in that occasion i click on the linl (yes i know…) but nothing happens later. Whats changed now?

Well, if you still have access to your account then change the password, NOW!!!! Also run a malware detector (malwarebytes is a good one) and an anti-virus package to make sure your computer is clean.

If your account has already been stolen then open a support ticket and explain how you were phished and support can help you recover it.

If you’ve entered your account information at that link, your account is compromised. Just because the thief has yet to do anything with your account doesn’t mean it is safe. It just means that he has a key to your house, as it were, and you need to change the locks before he gets around to coming in and stealing your socks.

If you clicked the link but did not enter any info, you still may have some malware on your computer. I’d suggest running a virus and malware scan and then changing your password and email.

i changed psw and added the phone thing on every login. i’ll try to run antivirus. Should i also contact gw2 support?

Gaile Gray.6028:

Brando.3891:

i changed psw and added the phone thing on every login. i’ll try to run antivirus. Should i also contact gw2 support?

If you were able to change your password, you should be ok. It’s great that you added mobile authentication — that will help greatly.

thank you for the reassuring answer, so i’m ok now? i have to change my email or do something else?

P.S. sorry for my english

Gaile Gray.6028:

Brando.3891:

Gaile Gray.6028:

Brando.3891:

i changed psw and added the phone thing on every login. i’ll try to run antivirus. Should i also contact gw2 support?

If you were able to change your password, you should be ok. It’s great that you added mobile authentication — that will help greatly.

thank you for the reassuring answer, so i’m ok now? i have to change my email or do something else?

P.S. sorry for my english

Personally — and this is just me being extra careful — I might be tempted to contact Support and get assistance in changing the e-mail account used to log in to the account. So if you’re using XXX@emailprovider.com, maybe changing to ABC@anotherprovider.com would be a good idea. Support can help you with that, once they have established for certain that you are the owner of the account. (This is for security, as I’m sure you understand.)

If you were able to access the account and change the password, you’re probably just fine. But if you feel that someone may have access to credentials that would allow him or her to try to get access – for instance, try to submit a support ticket to claim the account – then perhaps a more careful choice is in order.

Thank you i have contact the support.

Hey,
This is probably the third or 4th time I’ve received the following email..

Guild Wars Account Will Be Shut Down Inform

We are sorry to inform you that your login account will be shut down or partially limited within 72 hours due to currency transactions or abnormal login. If you want to remove restrictions, please click the following link to validate::
[[[link redated]]]

The Guild Wars 2 Team

The email is from : noreply@guildwars2.com

Is this legit? I’ve been ignoring the emails before because I thought if was a dodgy attempt to steal my password, but it is the correct email. No one else other than me uses my account and the only “transactions” are me buying gems. Occasionally I have to re-authenticate because my ip sometimes changes.

I was hoping someone could tell me if this is a legit email and why I keep getting it.

Thanks
Stuart

It’s fake. There’s info in a “phishing” emails stickied thread.

You’re probably going to get these for years to come.

You’re getting them, along with many other people, because your email address appears on one or more email lists that are possessed by the people sending out the emails. They’re just trying to get your account credentials. Don’t click anything.

And no, it’s not a breach in ArenaNet’s system. Even people who have never played GW1 or GW2 get them, just like I get the same types of emails for other games I’ve never played.

Thanks for the reply gassy,
I wouldn’t have done it anyway, like i said ive ignored another 3 or 4 and nothings been banned yet. I’m quite used to emails like this but as the email address it was sent from was correct, I thought I had better check.

Thanks

Ok, got a new phising mail. The header says “Security question reset request”

In the mail, it asks me to verify my email. I removed the link in the mail:

Greetings!

Please read this e-mail carefully, as it is related to your account state of Guild Wars 2 account.

First and foremost, I’d like to let you know that we take matters of account very seriously. It has come to our attention that you are trying to sell your personal Guild Wars 2 account. As you may not be aware of, this conflicts with the EULA and Terms of Agreement. If this proves to be true, your account can and will be disabled.

Click on the link below to verify your Guild Wars 2 account e-mail address:
(link removed)

If you ignore this mail, your account will be permanently closed. Once we verify your account, we will promptly reply to your E – mail to inform you that we have abandoned the investigation.

Please keep in mind that Guild Wars 2 is a global game with hundreds of thousands of players. This means that standards of behavior must be upheld. For your convenience, you can obtain more information about our rules at the address listed below.
(link removed)

We’ll see you in-game!

The Guild Wars 2 Team

So it doesn’t really ask to reset my security question, but asking to verify my email address. The grammar is actually quite bad in the mail.

As a rule, Arena Net does not initiate contact with you, ever. If there is an issue with your account, Arena Net tends to lock first (to limit any damage) and wait for you to contact them.

I purchased Guild Wars 2 about 5 weeks ago and I love the game, it’s the only game I’ve played since I bought it!

I received an email on the address that I used to create my GW2 account from “Arenanet” saying..

Greetings!

Please read this e-mail carefully, as it is related to your account state of Guild Wars 2 account.

First and foremost, I’d like to let you know that we take matters of account very seriously. It has come to our attention that you are trying to sell your personal Guild Wars 2 account. As you may not be aware of, this conflicts with the EULA and Terms of Agreement. If this proves to be true, your account can and will be disabled.

Click on the link below to verify your Guild Wars 2 account e-mail address:
https://account.guildwars2.com/account/login-support.html

If you ignore this mail, your account will be permanently closed. Once we verify your account, we will promptly reply to your E – mail to inform you that we have abandoned the investigation.

Please keep in mind that Guild Wars 2 is a global game with hundreds of thousands of players. This means that standards of behavior must be upheld. For your convenience, you can obtain more information about our rules at the address listed below.
https://www.guildwars2.com/en/legal/

We’ll see you in-game!

The Guild Wars 2 Team

I am NOT trying to sell my account, this game is amazing there’s no way I’d spent over 160 hours playing and then just sell my account, is this email legit because the link that’s in the email sent me to a webpage that does not look real at all, it asks for my gw2 account details including password.. I didn’t do anything because it seems a bit dodgy but I do NOT want my account to be permanently closed.. :/

I purchased Guild Wars 2 about 5 weeks ago and I love the game, it’s the only game I’ve played since I bought it!

I received an email on the address that I used to create my GW2 account from “Arenanet” saying..

Greetings!

Please read this e-mail carefully, as it is related to your account state of Guild Wars 2 account.

First and foremost, I’d like to let you know that we take matters of account very seriously. It has come to our attention that you are trying to sell your personal Guild Wars 2 account. As you may not be aware of, this conflicts with the EULA and Terms of Agreement. If this proves to be true, your account can and will be disabled.

Click on the link below to verify your Guild Wars 2 account e-mail address:
https://account.guildwars2.com/account/login-support.html

If you ignore this mail, your account will be permanently closed. Once we verify your account, we will promptly reply to your E – mail to inform you that we have abandoned the investigation.

Please keep in mind that Guild Wars 2 is a global game with hundreds of thousands of players. This means that standards of behavior must be upheld. For your convenience, you can obtain more information about our rules at the address listed below.
https://www.guildwars2.com/en/legal/

We’ll see you in-game!

The Guild Wars 2 Team

I am NOT trying to sell my account, this game is amazing there’s no way I’d spent over 160 hours playing and then just sell my account, is this email legit because the link that’s in the email sent me to a webpage that does not look real at all, it asks for my gw2 account details including password.. I didn’t do anything because it seems a bit dodgy but I do NOT want my account to be permanently closed.. :/