Ok, so I'm a bit of a newb when it comes to networking but this seems quite odd to me. I can't fathom a way this information is being spoofed. Anyway...
Warmane appears to host its login.warmane.com service on AWS. The IP for this service is located on AWS (Amazon Cloud)
After connecting to a realm you're then connected to OVH at 37.187.173.57
As far as I know you can't spoof source and destination with TCP, so it seems like Warmane is hosting on OVH.
If that is the case how do they not get a C&D but Nostalrius does?