Guild Wars 2

I’ve just received a second one.

Yes, it’s a scam.

How do they make it so that it shows the email is sent from noreply@guildwars2.com?
This kitten es me off quite a bit. I’ve received 3 of this darn email 3 times today.

What are they trying to do anyhow? What’s the point of this?

DashingRogue.6592:

How do they make it so that it shows the email is sent from noreply@guildwars2.com?
This kitten es me off quite a bit. I’ve received 3 of this darn email 3 times today.

If I knew your email address, I could send you email that looks like it came from you. If I knew your friend’s email address, I could send you email looking like it came from that person. It’s just a string of text that can be changed to anything using many email providers and many email clients. As long as it has a valid format, most email servers will happily send it along.

Also, for whatever it’s worth. I haven’t played this game in months. It’s not even installed on my PC.

Far more concerned about my email account.

I just received one of those scam e-mails looks legit but i have nothing to do with selling my account, how do we get hold of someone on this {REDACTED}

Yeah I got the same email today. It looks fishy as I’ve never tried to sell my account. Plus those links don’t look right. Already put it in junk files. Hopefully Anet could do something about these scammers.

Rafujin.1498:

just received one too. i wonder how they got my email :/

Do you receive similar phishing messages regarding selling WoW/Diablo 3/Runescape accounts? If so, that means your e-mail address is basically on a spam list that’s sold from one hacker to another. These are just giant databases of e-mail addresses that have been harvested from hacked websites/forums in the past. The hackers know that someone who plays an MMO is likely to go on to play more MMOs in the future, so they just spam these e-mail addresses with fake warnings for a variety of games in the hopes that someone will bite.

If you just ignore/block the spam messages, eventually they’ll stop coming because the hackers occasionally prune the databases to remove listings that bounce back or receive no responses. Until they sell the list to a new hacker and the whole process starts over.

Icedsnake.6352:

i hear you , sorry for my stupidity … normaly im well aware of this kind of fishing email but for some reason this one got to me , but 3min afther i did it i posted here and with your help i immediately changed my password to be sure i would not get hijacked.
Not too long ago , my DeviantArt account was terminated because i ignored a email exactly like that one so maybe thats why i just panicked and clicked the link and gone with it…

Happens to everyone at some point… way back in 1995 or so I logged into America Online for the first time and within an hour I almost fell for a scam from someone pretending to be an employee there…

tolunart.2095:

Icedsnake.6352:

i hear you , sorry for my stupidity … normaly im well aware of this kind of fishing email but for some reason this one got to me , but 3min afther i did it i posted here and with your help i immediately changed my password to be sure i would not get hijacked.
Not too long ago , my DeviantArt account was terminated because i ignored a email exactly like that one so maybe thats why i just panicked and clicked the link and gone with it…

Happens to everyone at some point… way back in 1995 or so I logged into America Online for the first time and within an hour I almost fell for a scam from someone pretending to be an employee there…

Rofl, me too! I was like “waiiitttt a minute, I just read that no employee will ask for your password…”

Ahh the good old days of backdoor orifice, winnuke and people think forum QQ is bad..

Hey I just got the same thing so I’m putting up the information for other people to see it.

x-store-info:4r51+eLowCe79NzwdU2kRyU+pBy2R9QCuw1UQm9NN8olwrYQKGeJInjiTGrTig2kAFoHo9G88M3nGjsZwDHlwHs1m0sXurGREGzifKSp147zru8Xsj3MKzBSAtJvJ2Lw1ugrvQ7LzPA=
Authentication-Results: hotmail.com; spf=none (sender IP is 202.91.234.85) smtp.mailfrom=iqko@mhlvcbh.com; dkim=none header.d=guildwars2.com; x-hmca=none
X-SID-PRA: noreply@guildwars2.com
X-AUTH-Result: NONE
X-SID-Result: NONE
X-Message-Status: n:n
X-Message-Delivery: Vj0xLjE7dXM9MDtsPTA7YT0wO0Q9MjtHRD0yO1NDTD02
X-Message-Info: 11chDOWqoTmjqhOzvWWho21q+kODha+kY+RPQ+71L1o2lTeVmv20doSP9Zgyc8qL197H4unv6fdpA1H1pS6mG4E8atKDQ+UghqWpZOporhyAu2b4vDCQ9hXCxFZpnlKf+hPHQQH1sN1626SpBkbpJOvvM3LZmGLz
Received: from mhlvcbh.com ([202.91.234.85]) by BAY0-MC2-F44.Bay0.hotmail.com with Microsoft SMTPSVC;
Sun, 7 Apr 2013 11:11:56 -0700
Message-ID: <520D35ACB02BC30ED62187760DE76D94@mhlvcbh.com>
From: “ArenaNet” <noreply@guildwars2.com>
To: <XXXXXXXXX@hotmail.com>
Subject: Guild Wars Account-Notice
Date: Mon, 8 Apr 2013 02:12:39 +0800
MIME-Version: 1.0
Content-Type: text/html;
charset=“utf-8”
Content-Transfer-Encoding: base64
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2900.5512
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.5512
Return-Path: iqko@mhlvcbh.com
X-OriginalArrivalTime: 07 Apr 2013 18:11:56.0678 (UTC) FILETIME=[63CFB260:01CE33BB]

Greetings!

It has come to our attention that you are trying to sell your personal Guild Wars account(s). As you may not be aware of, this conflicts with the EULA and Terms of Agreement. If this proves to be true, your account can and will be disabled. It will be ongoing for further investigation by ArenaNet Entertainment’s employees. If you wish to not get your account suspended you should immediately verify your account ownership.

You can confirm that you are the original owner of the account to this secure website with:

https:// account.guildwars2.com/allow-login?token=E4627223-9087-4AC4-8BC7-9784C48EE197&request=E553AB6A-4825-4E6C-A278-00A2C6C305A9&ip=62.150.38.163.html

(real link that is hidden under that false URL is http:// account.guildwars2.com.tfoh.info/ )

If you ignore this mail your account can and will be closed permanently. Once we verify your account, we will reply to your e-mail informing you that we have dropped the investigation.

Regards,

Account Administration Team
Thanks! —The ArenaNet Team

Getting annoying. But that’s not an email tied to any of my GW2 accounts so… its more amusing heh

Edited to put spaces in the links to not make it clickable!

Got same email, link is slightly different ending with same IP address
62.150.38.163

IP : 62.150.38.163 Neighborhood
Host : xdsl-62-150-38-163.qualitynet.net
Country : Kuwait

Hello!

I just got an email from ArenaNet which has me a little worried. The email stated the following:

noreply@guildwars2.com::
Greetings!

It has come to our attention that you are trying to sell your personal Guild Wars account(s). As you may not be aware of, this conflicts with the EULA and Terms of Agreement. If this proves to be true, your account can and will be disabled. It will be ongoing for further investigation by ArenaNet Entertainment’s employees. If you wish to not get your account suspended you should immediately verify your account ownership.

You can confirm that you are the original owner of the account to this secure website with:

https://account.guildwars2.com/allow-login--the link goes on.

If you ignore this mail your account can and will be closed permanently. Once we verify your account, we will reply to your e-mail informing you that we have dropped the investigation.

Regards,

Account Administration Team
Thanks! —The ArenaNet Team
--————————————————————————————

Is this legit? It certainly seems so… and if it is, why am I getting this? I am certainly NOT trying to sell my account!

Could anyone shed light on this?

Please do not reply to this email. Do not click the link provided. Delete and mark this email as spam in your email spam filter. This is a gold seller trying to get access to your game account. You will keep getting these emails in the future. I repeat NEVER click on the link they provide in the email. Hope that is clear enough.

I did click it unfortunately, before coming here, because it seemed like a really legit email. However, I then came here, changed my password and posted this. Hope others will see this.

Thank you kindly.

Zaxares.5419:

Rafujin.1498:

just received one too. i wonder how they got my email :/

Do you receive similar phishing messages regarding selling WoW/Diablo 3/Runescape accounts? If so, that means your e-mail address is basically on a spam list that’s sold from one hacker to another. These are just giant databases of e-mail addresses that have been harvested from hacked websites/forums in the past. The hackers know that someone who plays an MMO is likely to go on to play more MMOs in the future, so they just spam these e-mail addresses with fake warnings for a variety of games in the hopes that someone will bite.

If you just ignore/block the spam messages, eventually they’ll stop coming because the hackers occasionally prune the databases to remove listings that bounce back or receive no responses. Until they sell the list to a new hacker and the whole process starts over.

Haha, I just checked one of my e-mails and what do you know, the spam filter is filled with Diablo 3, WoW and guildwars account notice warnings :P

Can people here delete the hyperlinks of the scam links ? I’m pretty sure some random guy will click on it, and will be all like “let’s connect to see what’s wrong with this” and bam his account got hacked… Put a printscreen, or delete the https:// text should do the job. I don’t think you want someone hacked because you posted the link

I got one of these too, except mine had a {REDACTED} after the url, and the fonts on the fake site were incorrect. :I

I received one of these today, looks really convincing, no typo and the address is very close.

Based on my recent experience having my account terminated here in GW2, I don’t recall ever receiving a ‘you shouldn’t do this, please log in’ warning e-mail prior to termination. The first notification I received was upon attempted log-in.

Also, you wouldn’t log into your forum account/game account, you would log into your support account which is separate and distinct from your game log-in.

Basically if any e-mail directs you to an account.blabla link, it’s usually a spearphishing attempt.

Hope that helps

Yeah i got the same mail. I get one for diablo 3, warcraft, and a lot of other mmo games i played like every week. Stupid kitten spam just trash them all. I still can’t believe that ppl still fall for it in 2013 oh well…

Got the same thing too today:
From: ArenaNet (noreply@guildwars2.com) Microsoft SmartScreen classified this message as junk.
Sent: Monday, April 08, 2013 1:36:10 PM
“Greetings!

It has come to our attention that you are trying to sell your personal Guild Wars account(s). As you may not be aware of, this conflicts with the EULA and Terms of Agreement. If this proves to be true, your account can and will be disabled. It will be ongoing for further investigation by ArenaNet Entertainment’s employees. If you wish to not get your account suspended you should immediately verify your account ownership.

You can confirm that you are the original owner of the account to this secure website with:

https://account.guildwars2.com/allow-login?token …..

If you ignore this mail your account can and will be closed permanently. Once we verify your account, we will reply to your e-mail informing you that we have dropped the investigation.

Regards,

Account Administration Team
Thanks! —The ArenaNet Team"

That email you got is word for word what they send trying to get Diablo 3 and WoW accounts as well

Arenanet never added a notification in GW1 that email verification was required to procede when logging in from a new server, like GW2 and this forum. You can log in and play, even though you did not verify your account. This has lead to a threatening email from Arenanet that states:

“It has come to our attention that you are trying to sell your personal Guild Wars account(s). " further “If you ignore this mail your account can and will be closed permanently.”

My wife and I are visiting my mother, leaving our gaming computers behind and playing on our laptops. We play both GW1 and GW2 and because our laptops are not capable of playing GW2 we only have GW1 loaded. Also because of our location, we check our email less frequently. So we have gone through two GW1 sessions unaware that email verifcations were required. Arenanet has somehow interpreted this as us SELLING our accounts. What a crock.

We have both submitted support tickets and expect the accounts to remain ours and NOT closed, although I have no way to check that until next week.

So beware!. If you play GW1 from a new location you will get NO warning that your account may be threatened!

did your e-mail look like this

https://forum-en.gw2archive.eu/forum/support/account/PSA-Scam-Emails/first#post1784764

If you used the link in the e-mail you should change your password right away.

Hi,
Firstly, I have never needed e-mail verification to log into GW. Doing so has not changed since GW2 came out (at least on my PC).
Secondly. If you replied to that e-mail: log in now, change your e-mail password, your GW/GW2 password and any other details you may have given the scammer at the other end.

Thanks for the warning and that is scary, but it is very much from Arenanet. When I went to my email, there were two log in verification requests from when we logged into GW1 and the threatening email from Arenanet. My wife had the same thing. Response was to account.guildwars2.com/allow-login blah blah blah, through an https.

When I logged in to the forum, it gave me a warning, unlike logging into GW1 and I was able to verify the server and set it as allowable in the future.

Thanks again for the warning though and everyone should look their links over carefully before proceding

Comicus,

If you are on the same computer, at the same location, you only have to worry about it once. When you use a different computer on a different server, Arenanet will ask for verification via your email that you are the one doing this. Its a good security measure and I have no problem with it other than they have not gone back and fixed GW1 to give you a warning that the security verification is required and that they feel the need to acuse you of selling your account first and then figure out whats going on.

Sven, the sender of that e-mail spoofed Anet’s address. If you clicked on the link provided, you just corrupted your PC.

We can not stress enough: that email is NOT from ArenaNet. It is a phishing scam email. Do immediately change your passwords. Do not fall prey to this scam. Please.

I appreciate everyones concern about the phishing scheme but the actions that occurred are consistent with Arenanets security procedures and the emails we received were from Arenanet.

1. We were NOT on our normal computers and logging in from new servers. we were logging in to GW1 NOT GW2 and both of us received the appropriate verification emails that should have prevented us from continuing. However, no warning was provided IN GAME on GW1 and so the emails were not responded to, but yet we were able to continue and play. We did this twice, and that raised an alarm at Arenanet .

All the addresses are legitimately Arenanet. They just have not implemented an ingame warning in GW1 when a verification requirement email is sent.

Verification requests were consistent with when we were logging in. We did not respond until much later so the verifications failed.

Sven Bow.1826:

I appreciate everyones concern about the phishing scheme but the actions that occurred are consistent with Arenanets security procedures and the emails we received were from Arenanet.

1. We were NOT on our normal computers and logging in from new servers. we were logging in to GW1 NOT GW2 and both of us received the appropriate verification emails that should have prevented us from continuing. However, no warning was provided IN GAME on GW1 and so the emails were not responded to, but yet we were able to continue and play. We did this twice, and that raised an alarm at Arenanet .

All the addresses are legitimately Arenanet. They just have not implemented an ingame warning in GW1 when a verification requirement email is sent.

Verification requests were consistent with when we were logging in. We did not respond until much later so the verifications failed.

No they’re not. The e-mail address was spoofed. Sorry mate, but you’ve been tricked. I recommend wiping your harddrive with a format, and reinstalling your OS. I have a feeling you clicked on that link, and now your PC is infected.

I guess you’re set in your decision. We’ll see you in a month when your complaining cause your account was terminated for botting/gold selling and you have never done anything.

Sorry mates but I will advise you of Anets response to the ticket. The only important point is that Anet has not included a verification notice warning in GW1. All the emails are from Arenanet and legitimate.

Sigh…ok, one last time….

Did you happen to notice all the other emails just like yours that people have received recently? All those phishing emails? The forum has several threads on this issue. All of those people received emails about ‘Guild Wars’, not Guild Wars 2, and some people do not even own Guild Wars (1).

I do hope you got the only legitimate email out of the bunch, but the evidence seems to indicate otherwise.

Regardless, I wish you good luck.

Nice try Bow… they even added a message on facebook about all this. The emails telling
“It has come to our attention that you are trying to sell your personal Guild Wars account(s). " further “If you ignore this mail your account can and will be closed permanently.”
are fake and if you believed in this, then watch how your account will be hacked in a few days. The real staff will never ever put this : “It will be ongoing for further investigation by ArenaNet Entertainment’s employees” in an email to a customer…

Quote:

Some members of the community have been receiving emails titled “Guild Wars Account–Notice”. This is a phishing email, not sent by us–please ignore it and do not click the links contained within. ~RB2

source: https://www.facebook.com/GuildWars2?ref=stream

I also just received this notice in my spam folder.
So can we confirm that it is a scam?

Yes I’d say they are definitely scams and I’ve been receiving them as well, and you can probably tell they are as if you ever click on the links they provide you in the email, you’ll notice the address bar displaying an address that may look like an official arenanet webpage address but with slight “adjustments” such as an added “z” somewhere.

Welp, we tired to help you. You refuse to believe that the threatening e-mail is fake. I understand your pride is at stake, but the link provided by other players clearly shows a fake login site.

I got this email today. Thought you all might what a look at it. I removed some of the url but take a look at this.

Greetings!

It has come to our attention that you are trying to sell your personal Guild Wars account(s). As you may not be aware of, this conflicts with the EULA and Terms of Agreement. If this proves to be true, your account can and will be disabled. It will be ongoing for further investigation by ArenaNet Entertainment’s employees. If you wish to not get your account suspended you should immediately verify your account ownership.

You can confirm that you are the original owner of the account to this secure website with:

{REDACTED}

If you ignore this mail your account can and will be closed permanently. Once we verify your account, we will reply to your e-mail informing you that we have dropped the investigation.

Regards,

Account Administration Team
Thanks! —The ArenaNet Team
--———————————

It came from,
IP Address: 218.71.140.187
ISP: Beilun Education Net
Region: Ningbo (CN)

(sender IP is 218.71.140.187) smtp.mailfrom=zrnb@vascfdi.org; dkim=none header.d=guildwars2.com; x-hmca=none
X-SID-PRA: noreply@guildwars2.com

They set it up to make it look like its coming from noreply@guildwars2.com. If you look at the url you will see something that should be obvious.

Words:
allow-login?token, request, ip=62.150.38.163
First is is saying it wants to allow a login. Second is a request, third what ip address is requesting it.

IP Address: 62.150.38.163
ISP: QualityNet
Organization: Qualitynet Co.
Region: Kuwait (KW)

Yep, completely wrong. A total scam and a lie. They are trying to hard too. Your email will read it as if it really come from noreply@guildwars2.com and unless you look at the message source code you don’t even know it wasn’t sent from noreply@guildwars2.com. But the url was a good giveaway that some one wants you to say its ok to log into my account and steal your stuff.

I received an email from noreply@guildwars2.com but I’m not sure if it’s a legitimate email from ArenaNet. It claims I’m trying to sell my account (which I’m not) and asks me to click a link to verify that I’m the owner of the account. So is this real?

Gaile, as you can see, some of us have been trying to assist other players with the latest phishing attempts. While I believe a majority of the GW2 playerbase understands what a Phishing attempt is, there are those who firmly believe what they see/read. I kinda feel bad for the guys who still insist Anet is trying to close their accounts because of this fake e-mail.

While, computer security is up to the individual, I can’t help but feel the Support Team is going to get flooded with “Hack” tickets. Will Anet be releasing a news post explaining that these e-mails are scams? If it shows up in the news area when we first log in, that might help to spread the word on the situation.

Vital.8516:

Yep, completely wrong. A total scam and a lie. They are trying to hard too. Your email will read it as if it really come from noreply@guildwars2.com and unless you look at the message source code you don’t even know it wasn’t sent from noreply@guildwars2.com. But the url was a good giveaway that some one wants you to say its ok to log into my account and steal your stuff.

Another indication that this is false is such an email would come from Support, not the advertisement email.

protip:

Look at the “raw/source” of the email, there are few things that’s visible from one of the examples above:

KibaOokami.6942:

Authentication-Results: hotmail.com; spf=none (sender IP is 202.91.234.85)
Received: from*mhlvcbh.com* ([202.91.234.85]) by BAY0-MC2-F44.Bay0.hotmail.com with Microsoft SMTPSVC;

AFAIK ArenaNet servers are definitely not located in China (from IP) and NO legit company use SMTP servers named like mhlvcbh.com.

Phishing emails are “normal” (mostly got stopped by spam filters but some get trough) and as people already suggested:

NEVER, EVER, AND I MEAN NEVER FOLLOW ANY LINK RECEIVED IN EMAL!!

• even if looks legit (spoofing sender address is very/extremely easy)
• even if threatens to nuke you if not replied
• even if offers you $$$$$
• even if promises 1k years of bad luck if not responded
  …

All serious companies will have copy of the notice (if really sent) when you login on your account page (NOT USING LINKS) by typing address in your browser (our using your bookmark).

As it’s stands now, everyone is responsible to keep his/her machine clean and not blindly “trust” in anything received from the internets.