Guild Wars 2

yea same, i just got an email like that, i think its time to make a new email to sign up to things… again :P sick of getting junk like this, i dont even play wow anymore and they still send those stupid emails

Ok guys i’m going to drop a not so secret here.

Email servers can send emails from any address they want without verification.

I can send you an email from my computer in my house to your email box that says its from noreply@arena.net

It isn’t even hard and can be done with a simple script. Or even manually, with a telnet connection.

Now a lot of email providers and ISP’s will attempt to verify it through all sorts of wizardry I wont get into here, and when it seems fishy to them they will put it in your junk folder or just might outright block it depending on the settings of the receiving mail server.

What can be useful to arenanet and your ISP provider is if you copy the header data of the email. This information contains the actual source of the email message, which is decidedly not arenanet.

Below is an example headerdata that proceeds an email message. I would recommend you not post it here unless you edit out your email address less hackers scanning the forums can use that to identify what email account belongs to your game account, but you can probably email arenanet support, and flag the message as spam without any real messages from arenanet getting blocked.

From IGN Deals: Mixed Bag Wed Apr 10 11:04:23 2013
X-Apparently-To: xxxxxxxxx@yahoo.com via 98.136.214.201; Wed, 10 Apr 2013 18:05:26 +0000
Return-Path: <mail@mail.ign.com>
Received-SPF: pass (domain of mail.ign.com designates 74.201.49.23 as permitted sender)
aG9wICYgYW4gSW5mcmFyZWQgUkMgSGVsaWNvcHRlciB3aXRoIEd5cm9zY29w
ZT8gRG9lcyB0aGlzIGUtbWFpbCBsb29rIGphY2tlZCB1cD8gVmlldyBhcyBh
IHdlYnBhZ2UgY2hyaXMsIFdlJ3JlIEZldGNoaW5nIHRoZSBCZXN0IERlYWxz
IFNvIFlvdSBEb24ndCBIYXZlIFRvLi4uLkh1cnJ5LCBNYW55IG9mIFRoZXNl
IEV4cGlyZSBEYWlseSBEZWZpYW5jZSAkNTkuOTkgKyBGUkVFIAEwAQEBAQN0
ZXh0L3BsYWluAwMwAgN0ZXh0L2h0bWwDAzY3
X-YMailISG: ShQUUJYWLDu8nbSVTswYIySj9wEoP2_ktZF4xrVylalnNIdu
JmEJqDTMVLGC2aTkFSirirCMjTPOGetRWwlhvQXNv4V6tVxPvXOzpcWWif1a
Ls5zSSqnlE6.l.1ZPg2MHoOY3_eaqwAP0BMftzST9fLPynHtHKp8mqK7NfmQ
rGLINbgNJnfzZxM0Lq9Ev9.kAh2wMlHJSaewyf1ScxbV_9klwRZMK7y0zMng
._YoVE1aBzwmki3R6Zmzdpqt_2x3MEIjdTHrsZPN1kItRgXmdaq8_A9v7m_L
0n8eYDoyQlT.9t0JDQHBX0vZ4xJp0C3EeNQQ3.0q6cnD9k46QI6vbd8UKs0B
VcZ86FvEoI_I9oVOLK2DXePPbrFPy5n6OI9zY2006wpzYTthqrs6hzcvDYY6
1PT1hZxwj_xP6t0YI02v4vL.HBT5OzF1fbCfP_EcS.vH5_a5Tpqai8bPvdLW
FoQdf4z7offaN955kOc3P6cpEqgpeZqtARGUxuEtNEDrkzcJSJhpxTaRUalO
d9I3uoWrpSwexJB1hI15hKW.87S3BBpE6emj2ac8hUckgpV12cnaP2H.pnRG
YA9ktmXantADtJYWSmaYQaScn852NH1.1yY_o8WWhxf06U7H8KUyG7U_LUHw
zP9Y_z6tl8r0wryIybRt3COrF_KSptZ4RO6SjJtKLTmFIPeSb37sXSfRsZXa
qB2mSfyhQ0WiLn8T6tBT68qQl6zQyqf9PskHaRq._oDQZvfHZF6eA2PNBETb
7943RVhUVf_TtjpNDfT1EVVmnan_xcdIjtryfLn0AJKgikIq66t5uZLklIMM
XEYdg90B3efcBLqYbYM7REjm1FEt4PFLP5rd9Zlu8CXIXvAbjTCl1_PmvGj9
gCsx7t99lsckJIzsvyzQKwWQDnFjFA5EKlD9GvEPb9KYF1BZDvePj5kJUh3F
OHytWELb7yIIes9UmeT13flRde73alwRijeMPLM18oumbfL7AQYdokittengw5j
A3A6SVfESVhrGT2SLuA7hmWB60Xbu.hctSpMXy4GOPnoW7gCNe36z9nhv9HQ
7OrY51wsVjUu31hZFF9GG3SECXTtnXjbDdmLUd6_eDhO44z5xBryqzK9fNrJ
czi0Ry8MLv4J.92gIWT4ROZN.TK8qONST9njlWVPazisa6TmI6CCcNWd257b
VDrhAcjOObdWRCsWtSOEL3AONVsm9M59vlYzafYBNaLnAY6W3AXKZy9TsHvS
HqL3_IvVU1pufvnK9_CRyRQF5BBor_N4qJ7U5YHbhwPxOkd9NpGs3wVVWTF6
C.kzSXxUrSDAieZoQZLWApc-
X-Originating-IP: [74.201.49.23]
Authentication-Results: mta1552.mail.ne1.yahoo.com from=mail.ign.com; domainkeys=pass (ok); from=mail.ign.com; dkim=pass (ok)
Received: from 127.0.0.1 (EHLO igndlbc.mail.IGN.com) (74.201.49.23)
by mta1552.mail.ne1.yahoo.com with SMTP; Wed, 10 Apr 2013 18:05:26 +0000
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=mail.ign.com; s=ign;
t=1365530663; bh=DlFriWAl8+LaQnetQPHTNUoMtLiUJ8qBjS6iyL/TnIw=;
h=DomainKey-Signature:Date:Message-Id:From:Reply-To:To:Subject:
MIME-Version:X-Mailer:List-Unsubscribe:Content-Type;
b=UN1mzjFDrVx38jZ915/aQpQCSNY55cxNyIvCvBfzCEqKt7RiF3rl1uuUc8uVz0gBr
kRUaOI2J5MaDUUalJ5Q1ei/utDSoYqXRlNOpldT1RpcvPqOBU742UenAHz3MNru
DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws;
s=ign; d=mail.ign.com;
h=Date:Message-Id:From:Reply-To:To:Subject:MIME-Version:X-Mailer:List-Unsubscribe:Content-Type;
b=K4GSpX1Plk/cbMGtTMdWBqvyTx6F0o4JB23oAXMY73lMdKtUMgCRtqJdHeQWXnLKWqevK9mmI7TT13+WkYAHk8QBjRysVvS7dbWQTf0V3R7UzHkfuJTEgN+bfB9UT39J;
Date: Wed, 10 Apr 2013 11:04:23 -0700
Message-Id: <1365617063.eb40.IGNM.765045.376053832MSOSI1.12OSIMS@mail.ign.com>
From: "IGN Deals: Mixed Bag" <deals@mail.ign.com>
Reply-To: "IGN Deals: Mixed Bag" <deals@mail.ign.com>
To: xxxxxxxx@yahoo.com
Subject: xxxxxxxxxxxxxxx
MIME-Version: 1.0
X-Mailer:ZetaMail50
List-Unsubscribe: <mailto:listunsub+LU+IGNM+765045+376053832+xxxxxxxxxx=yahoo.com@mail.IGN.com>
Content-Type: multipart/alternative; boundary="---===_OSI_MRIANVNII_16062001_31091.1365617063-7712"
Content-Length: 69859

ShadyNZL.9018:

My question is where are these scammers getting email addresses from? How are they targeting actual GW2 players and being so accurate? I mean there’s been A LOT of people complaining about this recently….

They arnt being accurate at all (I know several email boxes that have been hit that don’t have guildwars 2 accounts). But part of it can be harvesting off of guild wars 2 fansites. Part of it is email addresses just harvested off of general gaming websites, and some of it is from the lists for wow accounts they already have. Scattershot that email, a few saps fall for it and then we get headaches. Fortunately arenanet has email verification on for most people, which should keep your gw2 account safe, but if your gw2 account and your email account share the same password both can be compromised.

Mousing over the link in the email shows “guildwars2.thz-game.pw.”

Sky Heart.4932:

yea same, i just got an email like that, i think its time to make a new email to sign up to things… again :P sick of getting junk like this, i dont even play wow anymore and they still send those stupid emails

I usually use a different email address alias every time I sign up at a web site or service. Any email sent to the alias gets sent to my main email account. This way when I get spam I can look at the “to” field to see how the spammer likely got my email address.

It’s a pain to use a different email alias until you realize the benefits outweigh the disadvantages.

I received one of these e-mails today, and it made it into my regular inbox, not junk mail, which is pretty unusual. It’s consistent with the others, but the English is better. Is ANet collecting any information on these, taking any action, or shall we just delete and ignore and feel bad for the more gullible among us?

I just received one of these and was going to post a thread asking about it. I am glad to see it is a scam that is being addressed.

{removing link in case this exposes any account info}

it makes u question the admin now tbh , has there been a breach of security , considering these people have managed to get hold of our emails , has there been a mention of this breach at all ?

Considering the fact that the one i got was to an email address that was not ever affliated with either Guild Wars its highly doubtful that a-net has been breached.

Whoopmeister.7493:

it makes u question the admin now tbh , has there been a breach of security , considering these people have managed to get hold of our emails , has there been a mention of this breach at all ?

If you use the same email address for multiple sites, that increases the chance of you getting spam or phishing emails. I use a different email address at almost every web site or service, and I can almost always tell which site sold my email address or was compromised. I started playing GW2 in August and also played GW1, and I have never received spam or phishing emails at the email addresses I used for them.

Gaile Gray.6028:

Sylv.6514:

I just received one of these and was going to post a thread asking about it. I am glad to see it is a scam that is being addressed.

{removing link in case this exposes any account info}

Hey there. I worry the image may show personal account info, and because we don’t need to see the image, I’ve redacted it. Hope you don’t mind!

Oh, and I’m glad this thread was helpful to you.

Actually i edited out any info that would give away my account. I don’t really mind it being removed though.

The recent light of these ‘emails’ i would like to know if you, Anet or Guildwars 2 have a security issue which is why are email addresses have been linked to Guildwars 2?

Doubtful.
These kind of mails have always been sent out, from different “companies” even without you having an account with that company (Blizzard comes to mind, where I have gotten WoW-notices for years without ever playing WoW or not having a Battle.net account.)

I would not worry much, the ones I get are yahoo bulk.. and I get them “apparently to” my account even if only the first 4 digits/numerals match. I’ve yet to see one addressed to my actual e-mail address. Most times they are not even the right domain name, or whatever that is. Im on Frontiernet and this phishing spam will send me stuff addressed to yahoo.net.

Four more emails from these clowns today alone. Well, they’re as persistent as they are annoying.

They’re not even going to the email I have my account tied to, which is relieving.

Draygo.9473:

Ok guys i’m going to drop a not so secret here.

Email servers can send emails from any address they want without verification.

At least guildwars2.com and ncsoft.com are using SPF records though, so while a server can still try to send mails under their name, any decent spamfilter should sort it out unless any of these entries accidentially contain a spam relay, which I doubt.
guildwars2.com text = “v=spf1 include:mailgun.org ~all”
ncsoft.com text = “v=spf1 include:_netblock_rnw.ncsoft.com include:_netblock_global.ncsoft.com include:_netblock_global01.ncsoft.com include:sgizmo.com ip4:211.189.163.230 ip4:211.189.163.231 -all”
The arena.net domain lacks an SPF record btw.

Just got one today and thought “god kitten it, kittens are after my Guild Wars 2 account now.”

Been after my WoW and AION accounts for years…and I haven’t touched those games in years…

Glad to see ArenaNet is aware of the scam mails.

I’m really happy this discussion is in the open forums for all to see. The more players are educated in these scams, the less complaints there’ll be about security breaches and such.

The sick sad thing about the email to me is I got on. Just not in the email I registered my copy of the game with LoL. But yes I have it and I am reporting it .

A log-in attempt from the following location is currently awaiting your authorization.

Address: 124.228.44.162
City: Beijing
Region: 22
Country: CN

This location is approximated based on information provided by your Internet Service Provider. If in doubt, deny the request and try again.

If you are certain this log-in attempt was not made by you, then someone else knows your log-in credentials and you should change your password immediately via Account Management.

For security purposes, we alert you each time your account is accessed from an unrecognized location. To authenticate this log-in attempt, please click the link below:

Wars account? Visit our support site: http://en.support.guildwars2.com/
Thanks!
—The ArenaNet Team

means someone in China has your password. You should scan your PC and change your password

Perhaps this should be ‘stickied’? I received 4 of those emails and thankfully they landed in my junk folder. Since I never considered selling my account and it’s still up, pretty sure it’s a scam.

Hello, I just got an email. I did not click on the link. Is this a valid email? I am coping and pasting it below. I am in no way attempting to sell my account. I love this game far to much to even consider that. Seek advice from the community as how to proceed with this. Thank you all.

ArenaNet (noreply@guildwars2.com)

Add to contacts

4:54 PM

Greetings!

It has come to our attention that you are trying to sell your personal Guild Wars account(s). As you may not be aware of, this conflicts with the EULA and Terms of Agreement. If this proves to be true, your account can and will be disabled. It will be ongoing for further investigation by ArenaNet Entertainment’s employees. If you wish to not get your account suspended you should immediately verify your account ownership.

You can confirm that you are the original owner of the account to this secure website with:

If you ignore this mail your account can and will be closed permanently. Once we verify your account, we will reply to your e-mail informing you that we have dropped the investigation.

Regards,

Account Administration Team
Thanks! —The ArenaNet Team

That is a phishing email. Please remove the link therein. Ignore and delete the email, as it is a scam trying to get details on your account.

https://forum-en.gw2archive.eu/forum/info/news/E-mail-from-ArenaNet/first#post180786

Thank you Inculpatus. I did remove the link. I went into panic mode when I seen the email. I just read the link you provided before I came back to this one. I am at ease now.

I am happy to hear your fears are alleviated. Silly email scams! =)

Iruwen.3164:

Draygo.9473:

Ok guys i’m going to drop a not so secret here.

Email servers can send emails from any address they want without verification.

At least guildwars2.com and ncsoft.com are using SPF records though, so while a server can still try to send mails under their name, any decent spamfilter should sort it out unless any of these entries accidentially contain a spam relay, which I doubt.
guildwars2.com text = “v=spf1 include:mailgun.org ~all”
ncsoft.com text = “v=spf1 include:_netblock_rnw.ncsoft.com include:_netblock_global.ncsoft.com include:_netblock_global01.ncsoft.com include:sgizmo.com ip4:211.189.163.230 ip4:211.189.163.231 -all”
The arena.net domain lacks an SPF record btw.

They should probably add one as it will help email providers to properly put these emails into the spam folder.

simplesimon.2084:

means someone in China has your password. You should scan your PC and change your password

Exactly, and by posting that link on the forum, now the spammer can click it and gain access to your account! I have reported this to the moderator.

@Anz

A moderator kindly removed the link from your post, but keep in mind if ANY reader on this forum clicked that link, hackers now have access to your account at this VERY MOMENT.

Please navigate to https://account.guildwars2.com/account/security and check to see if 124.228.44.162 is under authorized networks, if it is remove it right away!

In the future please refrain from copy/pasting confidential information from email, always be sure to remove activation email links!

And remember ArenaNet sent you that email because that hacker group already has your password, you need to change your GW2 account password ASAP.

Whelp, I finally got one. Should have searched before I made a post. Hmmm.

However, on a side note, I hope no one has the bogus email and perverted password I gave them.

Today i recieved this message:
"
Greetings!

It has come to our attention that you are trying to sell your personal Guild Wars account(s). As you may not be aware of, this conflicts with the EULA and Terms of Agreement. If this proves to be true, your account can and will be disabled. It will be ongoing for further investigation by ArenaNet Entertainment’s employees. If you wish to not get your account suspended you should immediately verify your account ownership.

You can confirm that you are the original owner of the account to this secure website with:

XXXXXX

If you ignore this mail your account can and will be closed permanently. Once we verify your account, we will reply to your e-mail informing you that we have dropped the investigation.

Regards,

Account Administration Team
Thanks! —The ArenaNet Team"

from: ArenaNet (noreply@guildwars2.com)

This is fake right?

It’s fake. FIRST delete the link you posted.

Then read this: https://forum-en.gw2archive.eu/forum/info/news/E-mail-from-ArenaNet/first#post1807866

longer thread here: https://forum-en.gw2archive.eu/forum/support/account/Email-from-ArenaNet-Please-read

But please delete that link.

Its purely fake, don’t think that link will work. If you hover over it – it probably isn’t going to guildwars2.com (in your email).

Delete that link from the forum if it is real, I notified a mod to have him remove it just in case you don’t see this.

Thank you for quick responding.

I deleted the link.

Mod, the topic can be closed.

Had a couple of these phishing scam emails, even before I bought GW2 hehe, and as an ex wow player, I don’t fall for them. However, I can’t find anywhere to report them to, do ArenaNet have a hacks address to forward them on to?
Also I’m assuming that if I set my outlook to block all emails from the sender it would block all legit emails from ArenaNet too, or can it differentiate between legit and faked senders via the message source details?

I just received the same thing too, but I realized right away that it had to be a phishing scam. For those wondering how they got our emails, they just get a huge list of publicly made available emails from random companies, and send out mass emails to that list. I know cause I’ve never had a WoW account with Battlenet ever, and all the time I’m getting emails saying my account needs to be verified or its being sold for real money and my account is now banned til I do something about it. So yeah gotta love the phishing, scamming spammers of the world.

I use this when i get phishing email. Copy and paste url that is sent in email

http://www.google.com/safebrowsing/report_phish/?tpl=mozilla

make sure you are copying the target url, as often the phishers will make the link look like it is going to the proper destination.

This is the most recent email I got.

Greetings!

It will be ongoing for further investigation by ArenaNet’s employees.

We are concerned about whether your account has been stolen. In order to guarantee the legitimacy of your account, click the link below.
<their dumb link goes here>

Once your account authentication has been completed, we will check your account and let you know what we can do for you.

Need help or have questions about your account? Visit our support site: http://support.guildwars2.com/.

The Guild Wars 2 Team

When I click the link, the .com changes to .com.en and some other stuff.

It’s best to not click the link at all. Your browser will probably let you right-click the link (NOT left-click) and then select a menu option for copying the link’s target/destination location which you can then paste in a text editor. Or better yet, your browser might let you hover your cursor over the link to see the real destination.

Apparently i recieved the same phishing-mail 5 days ago on an old (!!!) e-mailadress.

I have received that email 4 times now over the last 3 days. On my account and my kids account. Don’t understand why. Only websites I visit regarding GW2 is here, dulfy and guru. I hope people are aware. Having had my GW1 account stolen later returned after a hassle finding all the serial numbers. Good to see Anet is aware of it and posted about it.

Hi Just thought id bring this email to your attention.

Obviously its some kind of phishing email but thought i’d report it.

It was a link but i removed it just incase somebody was silly enough to click on it

- Pure

ArenaNet (noreply@guildwars.com)Add to contacts 21:48
To: xxxxxxxxxxxxxxxxx

Greetings!

It has come to our attention that you are trying to sell your personal Guild Wars account(s). As you may not be aware of, this conflicts with the EULA and Terms of Agreement. If this proves to be true, your account can and will be disabled. It will be ongoing for further investigation by ArenaNet Entertainment’s employees. If you wish to not get your account suspended you should immediately verify your account ownership.

You can confirm that you are the original owner of the account to this secure website with:

account.guildwars2.com/allow-login?token=E4627223-9087-4AC4-8BC7-9784C48EE197&request=E553AB6A-4825-4E6C-A278-00A2C6C305A9&ip=62.150.38.163.html

If you ignore this mail your account can and will be closed permanently. Once we verify your account, we will reply to your e-mail informing you that we have dropped the investigation.

Regards,

Account Administration Team
Thanks! —The ArenaNet Team

Gotten a new one today, don’t know if it’s real or not:
From: ArenaNet (noreply@guildwars2.com) This message is in your inbox because you’ve indicated interest in this sender.
Sent: Tuesday, April 16, 2013 12:14:28 AM
To:

“Greetings!

It will be ongoing for further investigation by ArenaNet’s employees.

We are concerned about whether your account has been stolen. In order to guarantee the legitimacy of your account, click the link below.
https://account.guildwars2.com/account/login-support.html

Once your account authentication has been completed, we will check your account and let you know what we can do for you.

Need help or have questions about your account? Visit our support site: http://support.guildwars2.com/.

The Guild Wars 2 Team"
And it has GW2 logo on top of the mail.

What is going on x.x

It’s fake. Just delete it. Don’t click the links. If you need to access your account for anything, type guildwars2.com in your browser and access your account that way.