Guild Wars 2

I received this today and I am not sure where I should have forwarded this to bring to A-Net’s attention so I figured you guys at the Tech Forums would know what to do:

ArenaNet (noreply@guildwars2.com)
Add to contacts
11:57 AM

To: xxxxxx@xxxxxx.com
Picture of ArenaNet

Greetings!

It has come to our attention that you are trying to sell your personal Guild Wars account(s). As you may not be aware of, this conflicts with the EULA and Terms of Agreement. If this proves to be true, your account can and will be disabled. It will be ongoing for further investigation by ArenaNet Entertainment’s employees. If you wish to not get your account suspended you should immediately verify your account ownership.

You can confirm that you are the original owner of the account to this secure website with:

https://XXXXXXXXXXXXXXXXXXXXXXX (bogus link removed for your protection)

If you ignore this mail your account can and will be closed permanently. Once we verify your account, we will reply to your e-mail informing you that we have dropped the investigation.

Regards,

Account Administration Team
Thanks! —The ArenaNet Team

You should edit that link out since anyone clicking on gets caught in that trap.

I wanted A-Net to have it so they would know how to deal with it. PLEASE DO NOT CLICK ON THAT LINK GUYS.

Maugrem.7608:

I wanted A-Net to have it so they would know how to deal with it. PLEASE DO NOT CLICK ON THAT LINK GUYS.

No you need to remove the links completely so people don’t accidentally follow them. Then you should visit this thread:

https://forum-en.gw2archive.eu/forum/support/account/Email-from-ArenaNet-Please-read-merged/first

Please remove the links in your post completely.

Stating that my account had been stolen. However my browser will not open the link in it, which is likely a good thing as I can still play my game.
I have attached a screen shot of the e mail.
NanaEdie5093

It’s fake. Don’t click on the links. They are trying to steal your account.

ANet doesn’t contact people like that. If there is that sort of problem they freeze the account and wait for the owner to contact them.

sticky: https://forum-en.gw2archive.eu/forum/support/account/A-Note-about-Phishing-Emails-1

There wasn’t a way for me to add it here https://forum-en.gw2archive.eu/forum/support/account/A-Note-about-Phishing-Emails-1/first#post2556003 so I am posting it in this forum.

Greetings!

It will be ongoing for further investigation by ArenaNet’s employees.

We are concerned about whether your account has been stolen. In order to guarantee the legitimacy of your account, click the link below.

[link deleted but ended in arenanet-zh.pw
interesting, .pw is the pacific island country of Palau. I never knew that existed so at least I learned something new from this haha]

Once your account authentication has been completed, we will check your account and let you know what we can do for you.

Need help or have questions about your account? Visit our support site

The Guild Wars 2 Team

actually, after some more investigation I was finally able to do a whois on it, and here’s the info on it. It’s actually registered from Beijing.

Domain ID:CNIC-DO1103566
Domain Name:ARENANET-ZH.PW
Created On:2013-04-25T10:15:37.0Z
Last Updated On:2013-08-13T07:52:48.0Z
Expiration Date:2014-04-25T23:59:59.0Z
Status:TRANSFER PROHIBITED
Status:UPDATE PROHIBITED
Status:DELETE PROHIBITED
Status:RENEW PROHIBITED
Status:SERVER HOLD
Registrant ID:cz72vqf6isg7gz
Registrant Name:wang yan
Registrant Organization:wang yan
Registrant Street1:beijingshidaxingqu
Registrant City:beijing
Registrant State/Province:beijing
Registrant Postal Code:100000
Registrant Country:CN
Registrant Phone:86.1081234567
Registrant FAX:86.1081234567
Registrant Email:112040420@qq.com
Admin ID:cz72vqf6isg7gza
Admin Name:wang yan
Admin Organization:wang yan
Admin Street1:beijingshidaxingqu
Admin City:beijing
Admin State/Province:beijing
Admin Postal Code:100000
Admin Country:CN
Admin Phone:86.1081234567
Admin FAX:86.1081234567
Admin Email:112040420@qq.com
Tech ID:cz72vqf6isg7gza
Tech Name:wang yan
Tech Organization:wang yan
Tech Street1:beijingshidaxingqu
Tech City:beijing
Tech State/Province:beijing
Tech Postal Code:100000
Tech Country:CN
Tech Phone:86.1081234567
Tech FAX:86.1081234567
Tech Email:112040420@qq.com
Billing ID:cz72vqf6isg7gza
Billing Name:wang yan
Billing Organization:wang yan
Billing Street1:beijingshidaxingqu
Billing City:beijing
Billing State/Province:beijing
Billing Postal Code:100000
Billing Country:CN
Billing Phone:86.1081234567
Billing FAX:86.1081234567
Billing Email:112040420@qq.com
Sponsoring Registrar ID:H429656
Sponsoring Registrar IANA ID:120
Sponsoring Registrar Organization:Xin Net Technology Corp.
Sponsoring Registrar Street1:Sino-I Campus,No.1 Disheng West Street
Sponsoring Registrar Street2:Beijing Economic & Technological Development Zone
Sponsoring Registrar City:Beijing
Sponsoring Registrar Postal Code:100176
Sponsoring Registrar Country:CN
Sponsoring Registrar Phone:010-58022233
Sponsoring Registrar Website:http://www.xinnet.com
Name Server:NS2.DNSCEO.NET
Name Server:NS1.DNSCEO.NET
DNSSEC:Unsigned

I’m reporting them here:

http://registry.pw/report-abuse/

No real need to post the emails here unless they’re different from the ones in the stickied thread you linked, and the email you posted is indeed in that thread.

People will be getting these emails as long as the game is around. It’s not going to stop before then.

Great news! I got it blocked!!!
Hello,

Thank you for contacting us.

The domain name “arenanet-zh.pw” has been suspended from our end.

Please feel free to contact us, in case of further queries.

Regards,
Abuse Mitigation Team
.PW Registry.

I think I figured out why some player are getting lots of spam (and phishing) from the email address noreply@guildwars.com (and not from guildwars2.com).

The spf of the domain ‘guildwars.com’ is invalid:

• “v=spf1” “include:mailgun.org” “?all”

should be

• “v=spf1 include:mailgun.org ~all”

(like guildwars2.com)

Cheers
PS: Please notify me upon fixing.

Uman.6150:

I think I figured out why some player are getting lots of spam (and phishing) from the email address noreply@guildwars.com (and not from guildwars2.com).

The spf of the domain ‘guildwars.com’ is missing a space, and is therefore invalid:

• v=spf1include:mailgun.org?all

should be

• v=spf1 include:mailgun.org?all

Cheers

This explains a lot, I never figure it out how they could send the “noreply@guildwars.com” email whne it doens’t belong to them.

You can send email pretending to be anyone. If I knew your email address I could send spam or phishing emails pretending to be you.

I know, but it will be considered as a spam if the spf is configured properly.

Uman.6150:

I know, but it will be considered as a spam if the spf is configured properly.

I was responding to the comment about how people can send mail using a “from” domain that they don’t own.

Hello, I recieved an e-mail today that I’m not sure if it’s real or not. I’ve heard of scam e-mails floating around before, but I’ll attach a screen shot of the e-mail. I’ve blur out my name and e-mail for obvious reasons.

I’ve played the Guild Wars franchise for years and I would hate to have my account taken from me for something I wouldn’t dare do. If this is real, should I just sit back and let the support team investigate?

If the information helps, this is not the same e-mail I use for my Guild Wars 2 account. I use this e-mail on Guild Wars related websites, like Guild Wars 2 Guru, but that’s it. I don’t really use the actual e-mail I use to login to Guild Wars 2 for anything other than just that.

Thanks in advance.

Phising

Please see this thread:
https://forum-en.gw2archive.eu/forum/support/account/Email-from-ArenaNet-Please-read-merged/

Yes it is but kitten clear some mail out, 771 in inbox lol

Gaile Gray.6028:

Uman.6150:

I think I figured out why some player are getting lots of spam (and phishing) from the email address noreply@guildwars.com (and not from guildwars2.com).

The spf of the domain ‘guildwars.com’ is invalid:

• “v=spf1” “include:mailgun.org” “?all”

should be

• “v=spf1 include:mailgun.org ~all”

(like guildwars2.com)

Cheers
PS: Please notify me upon fixing.

That’s interesting. I’m not sure if we can make the changes suggested, but I’ve passed it along to the team responsible for sending out our emails. Thanks!

Well someone has fixed it already.

guildwars2.com. 428 IN TXT “v=spf1 include:mailgun.org ~all”

Gaile Gray.6028:

Khisanth.2948:

Gaile Gray.6028:

Uman.6150:

I think I figured out why some player are getting lots of spam (and phishing) from the email address noreply@guildwars.com (and not from guildwars2.com).

The spf of the domain ‘guildwars.com’ is invalid:

• “v=spf1” “include:mailgun.org” “?all”

should be

• “v=spf1 include:mailgun.org ~all”

(like guildwars2.com)

Cheers
PS: Please notify me upon fixing.

That’s interesting. I’m not sure if we can make the changes suggested, but I’ve passed it along to the team responsible for sending out our emails. Thanks!

Well someone has fixed it already.

guildwars2.com. 428 IN TXT “v=spf1 include:mailgun.org ~all”

Yep, thanks to Uman’s report, we got on that right away. This is an example of how great it is to have forums and to have such helpful players! ~major props~

Don’t forget having an amazing support liaison that’s paying attention and in communications with the community as well.

Not a bad gig for a frog, eh?

Actually, that’s not it.
The SPF of GW2 was good all along.

I’m getting this now:

uman@umw:~$ host -a  guildwars2.com
Trying "guildwars2.com"
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 49658
;; flags: qr rd ra; QUERY: 1, ANSWER: 9, AUTHORITY: 4, ADDITIONAL: 4

;; QUESTION SECTION:
;guildwars2.com.                        IN      ANY

;; ANSWER SECTION:
guildwars2.com.         1774    IN      TXT     "v=spf1 include:mailgun.org ~all"
[...]

uman@umw:~$ host -a  guildwars.com
Trying "guildwars.com"
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 29016
;; flags: qr rd ra; QUERY: 1, ANSWER: 9, AUTHORITY: 4, ADDITIONAL: 6

;; QUESTION SECTION:
;guildwars.com.                 IN      ANY

;; ANSWER SECTION:
guildwars.com.          1574    IN      TXT     "v=spf1" "include:mailgun.org" "?all"
[...]

To whom it may concern,

I just purchased and started playing guild wars 2 2.5 weeks ago. Before that, I never received an email from “ArenaNet”. I haven’t signed up for any sites, haven’t done any web searches for guides with the exception of accessing the wiki (through your link in the loader) and via Youtube. From day 1 of activating my account, I have received the “it has come to our attention that you are trying to sell your account” phishing scam email from the same Chinese IP 62.150.38.163. I believe your website has been compromised, or at the very least your outgoing mail server has an address sniffer on it. Please do something to fix this.

Community,

I have recently gotten several emails claiming that my account has been compromised when it actually has not.

The easiest way to detect these false emails is to hover (but do not click) on the link provided at the bottom.

The current scam shows the domain as guilwars2.co*.vc*m.c*.vu or something similar. Every few days they change the domain name slightly to prevent it from being blocked.

Travel safe!

Balrogz

hi all

going through my emails just a bout an hour ago i came across this (was recieved @

4:56 AM (17 hours ago)

Guild Wars Account Will Be Shut Down Inform

We are sorry to inform you that we found you have been used bots. We will give back your account in 72 hrs.Since you used it for a short time,we decide to offer a chance for you. Please, please click the following link to verify your identiy::
h**ps://account.guildwars2.com/login
Guild Wars 2 Team

this is my girlfriends account and she hasn’t played the game for ages and i think its kinda strange as she has a verify thing on the game so i dont understand how it would be hacked as we dont share info with anyone not even our children i checked if i could log in no probs there……..so is it a mistake?

just wondering

Anet will never send mails like this.
They are used by hackers to gain access to accounts.
Don´t click any of the links and just to be save, your girlfriend should change her passwords to her email and to the game.

This is spam – you can tell by the horrible English and general request. Pretty sure you can delete it/ignore it.

Hi,

Tried logging in to find many error messages. I checked my email account to find i have received 2 separate emails, one in my JUNK file and one in the normal INBOX.

The following is the email from the normal inbox:

Greetings!

It has come to our attention that you are trying to sell your personal Guild Wars account(s). As you may not be aware of, this conflicts with the EULA and Terms of Agreement. If this proves to be true, your account can and will be disabled. It will be ongoing for further investigation by ArenaNet Entertainment’s employees. If you wish to not get your account suspended you should immediately verify your account ownership.

You can confirm that you are the original owner of the account to this secure website with:

If you ignore this mail your account can and will be closed permanently. Once we verify your account, we will reply to your e-mail informing you that we have dropped the investigation.

Regards,

Account Administration Team
Thanks! —The ArenaNet Team

The second is the JUNK email, which seems more legit. Can someone please advise me on what is going on? I have never and will never try to sell my account, as i barely play it myself:

Greetings!

Due to an unusual change in your access pattern, the Guild Wars 2 account under this email address has been locked. This can be caused by logging in from a new location, but it may also signal an attempt to compromise your account. If you feel that your account’s security is at risk, please follow the steps below.

Step 1: Verify Your Account Ownership

Click on the link bel ow to verify your e-mail address of the Guild Wars 2 account:

Step 2: Secure Your Computer

Ensure that your computer is free from any malicious programs, as a password change alone may not deter future attacks. Visit our Account Security website to learn how to prote ct your computer from unauthorized access.

Step 3: Secure Your Email Account

Choose a new password for your email account and review your email for any filters or rules you did not create. For more information on securing your email account, visit our Account and Computer Security page.

Step 4: Choose a New Password

Change your password to resume using this Guild Wars 2 account, as your former password no longer grants access to any login-protected Guild Wars 2 account service or game. Visit our Password Reset page to begin the password change process.

Once you’ve regained access to your account, you can add additional security with Mobile Authenticator, a free service that allows you to unlock your Guild Wars 2 account on your own with a few simple steps. For more

information, see the Account Protect FAQ

—The ArenaNet Team

The past few logins, i have been asked to authorise my login, but i sign in from the same house and PC every single time. Now i am being accused of selling my accounts… I’ve been phished before on previous MMO’s and lost everything and i am not prepared to do anything until a mod can respond please!

Thanks

These are Phishing emails, Anet will never send an email if something is up with your account, there are many posts about it on the forum.

If you entered your password to those links change it to something else NOW – these are scams. Those links are not official GW2 websites.

The emails look reasonable to me, and the links ARE valid – they point at subdomains of the guildwars2.com domain which is what you are on right now.

The copy and paste of the emails though might have ‘fixed’ the links. If you look at the original emails and hover over the links, see whether they actually point to the same location or somewhere else. If the links don’t match, or obviously point somewhere strange (a raw ip, or some unrelated domain) then this can be safely discarded.

I would strongly suggest following the advice as seen here:
https://forum-en.gw2archive.eu/forum/support/account/Cant-login-even-after-changing-password/first#post2664826

- and contact support if you have any concerns, or have issues with logging in. Or wait for an official response on this thread – but they will most likely provide similar advice.

Also, for future reference, be careful of what you copy and paste. The first link you posted contains possibly sensitive information (your IP) along with time-limited access tokens that could potentially be abused.

EDIT: As bluestocking has pointed out, these match known phishing attempts. Delete and ignore them.

No, they are not legit emails. You can see multiple examples of the identical emails here. https://forum-en.gw2archive.eu/forum/support/account/A-Note-about-Phishing-Emails-1/first#post2074388

Also, OP, you should remove the links to prevent accidental clicks on them, as a mouseover clearly shows that it will redirect people to an external (non-GW2) site.

Deleted them cheers, i knew they were potential phishing emails but you can never be sure.

Could it be that there was within this email a link that changed your computer remote access settings?

My new laptop had its settings for remote access changed to allow anyone who found my ip address and my gw2 account and along with other things on my computer lost.

Do they ever make phishing attempts based on foreign log in attempts? Maybe hoping curious users would click and pick up a virus? I ask because this morning I received an email notifying me of a log in attempt from China. Checked for viruses first, then logged into my account (it was untouched) and immediately logged out again and changed my password to a crazy new one.

I’d like to think it was a phish… cos if it wasn’t, then it means some random dude on the other side of the world took the time to (successfully) crack my previous password. x_x Thank god for email authentication.

Cracking passwords is only necessary when they have lists of encrypted passwords. Since various lists of usernames and plaintext passwords are freely available for those who know how to find them, and since people tend to reuse the same usernames and passwords at many sites, it’s too easy for the evil doers to grab those lists and try them at various sites/games/services, including GW2.

If someone has your username and password, they likely got it from a site or guessed it based on a list of common passwords. I believe ArenaNet started blocking common passwords (yaaay! I wish more companies would do that), so I’d bet it’s the first scenario. While it’s possible some people lose their accounts doe to keyloggers, that’s generally unnecessary since people reuse credentials from site to site. Once a site is exposed (often a generic forum site that’s easily compromised), the list of users and passwords are grabbed and shared with others. Doing that is easier and more efficient than trying to get people to install keyloggers.

If you use the same username/email and password for other sites that you use for GW2 (either previous or current password), you should change those immediately.

If they used the list method then they probably already tried to clear out my (inactive) WoW character. That was the only thing I used the same details on, the only place they could’ve copied. My password was stronger than the “p4$$w0rd” type stuff but it was still kind of lazy…

Well, new and unique passwords from here on out. Maybe a new email too. Paranoid Mode: [ENGAGED]

Hi i recive this email, from arenanet.

I was recently hacked with this email, but mai account is restored

I found it funny when I read the email where ArenaNet were claiming that I’ve been trying to sell my account and I’ve been caught doing it. So what’s so funny? The fact that the address that received this email has no connection with Guild Wars 2 at all. It’s not even registered on ArenaNet. I still fell for it but realised immediately.

Makes me sad to know that people would do this.

Quantisaveri.3910:

To whom it may concern,

I just purchased and started playing guild wars 2 2.5 weeks ago. Before that, I never received an email from “ArenaNet”. I haven’t signed up for any sites, haven’t done any web searches for guides with the exception of accessing the wiki (through your link in the loader) and via Youtube. From day 1 of activating my account, I have received the “it has come to our attention that you are trying to sell your account” phishing scam email from the same Chinese IP 62.150.38.163. I believe your website has been compromised, or at the very least your outgoing mail server has an address sniffer on it. Please do something to fix this.

Same for me. I got a scam email right after making account, to the email I used to sign in with. That smells like someone either snooping traffic or stealing data in some other way.

If outsiders had access to ArenaNet’s customer database, I’m beyond 100% sure we would be flooded with spam at the email addresses we use for GW2. I have received a few phishing emails at an email address I only used at a couple of gaming sites not related in any way to GW1 -or- GW2.

Use a unique email address at EVERY site where you enter an email address so you will know how your email address was likely obtained. Re-using email addresses at multiple locations means you WILL eventually get phishing emails for site X shortly after registering at site X even when site X hasn’t been compromised.