Spam to plusnet-specific Email address.

[#1]

Quote from: purleigh

Perhaps you would like to fill in the ICO data mishandling questionnaire, and tell us what happens ?

I did, I just hadn't phrased the question at all properly.

Quote

From the ICO questionnaire: 2. Have you received a response? Have you received a full and final response from the organisation?

Answer 'no' to that and they basically give you the flick.
What I should have asked is "What qualifies as a full and final response?" End of complaints procedure? Deafening silence? I'd guess from your response you think the second qualifies if we're not expecting a further answer.
I'll let you know what happens, although the ICO's usual mild whimper in past cases doesn't inspire confidence.

[#2]

Quote from: purleigh

Just to point out that Plusnet "Broadband Phone" and the new CGI hosting platform, are both managed by external companies, and both have my Plusnet account email address.

I'll add them to my original list. Do you have to provide the email when you activate, or is it simply picked up if you use those services?

[#3]

This is all superb information, So we can now both spread the net a little wider, and add a couple of extra notes and questions.
My answers:
- Recommend to a friend? - Used around 4 times (I'm glad this one's ruled out)
- Support tickets? (uses the billing email address): - Yes
- Email address type (Plusnet system/ own domain): - own domain
- Address unique to plusnet billing? - PlusNet only, but unusually for me, I also used the same address for this forum, and luckily we've ruled that out
- Length of time account held with plusnet? - I think it's 11 years (going through, I think, 3 packages in that time, the most recent one for the last 5 years?)
- Length of time address was used with account? - 11 years
- Address passed to third party during support? - Not that I'm aware of - I note that we only get to see 1 year of history in the support ticket system, and I tend to archive my email onto a DVD once it's over 3 years old.
- Broadband Phone user? - No
- CGI-Hosting platform user? - I did use it at one point, although I can't remember what I was using it for, and I think that was before the changes were made to who provided the service. Goes off to check if he has FTP details well the password I have is not correct / the account doesn't exist. I've therefore thrown caution to the wind and submitted a forgotten password request, which has yielded... Nothing. So I think the answer is no, at least not in its current guise.

Also important to note: I use a different specific address for the Service Status emails (complete with a date in the mailbox part, and on a sub-domain; if only I'd been that mistrusting of everyone back in 2003!)
Kevin, with Madasafish, can you tell us anything more about the marketing emails you've had from them, or the support requests made to them?
Given who owns Madasafish it's looking just like a typical BT mistake, so let's pool our resources, gather the extra evidence we need, and if it is BT, make sure they're actually held accountable (for once),
James

[#4]

I've amended my original post with the list to add:
- Are you a Broadband Phone user?
- Are you a CGI-Hosting platform user?
- Has the address been used for 'status update' emails?
So the full list of questions is now:
- Email address type (Plusnet system/ own domain)
- Address unique to plusnet billing? (unused for other purposes)
- Length of time account held with plusnet?
- Length of time address was used with account?
- Address passed to third party during support?
- Are you a Broadband Phone user?
- Are you a CGI-Hosting platform user?
- Has the address been used for 'status update' emails?
Any more suggestions?

[#5]

Quote from: HolaPussycat

Kevin, with Madasafish, can you tell us anything more about the marketing emails you've had from them, or the support requests made to them?

I don't believe I've had any marketing emails. There have been a small number of support tickets, the last in 2011.

Quote from: HolaPussycat

Given who owns Madasafish it's looking just like a typical BT mistake, so let's pool our resources, gather the extra evidence we need, and if it is BT, make sure they're actually held accountable (for once),

Given that Madasafish is now just a brand name used by Plusnet, I'm not sure the BT connection is directly relevant, it's all effectively Plusnet (albeit owned by BT).

[#6]

My answers below:
- Email address type (Plusnet system/ own domain) own domain
- Address unique to plusnet billing? (unused for other purposes) No, also for forum and status updates
- Length of time account held with plusnet? 4½ years
- Length of time address was used with account? 4½ years
- Address passed to third party during support? not to my knowledge
- Are you a Broadband Phone user? no
- Are you a CGI-Hosting platform user? no
- Has the address been used for 'status update' emails? yes

[#7]

Well that makes sense, and really does point the finger squarely in Plus Net's direction.
While Plus Net need to deal with the questions asked, about who our data has been shared with (no matter how reliable they claimed to be), they should also be tackling this from the other end of the fritter.
Can someone at Plus Net (I think it's appropriate that it's a Plus Net employee, given that it's all PlusNet / Madasafish only addresses, as far as we can tell) contact the domain owner and ask them where they acquired this segment of their mailing list? (I'm not suggesting for a second that this is anything other than futile, but just for a second, let's assume that this is simply a misguided marketing type, who's bought a mailing list in good faith, and is just making a bit of money selling link generation). I'd recommend contacting them using an identifying email address on a disposable sub-domain!
How about contacting the registrar (enom.com) or their reseller (namecheap.com) and asking them to give us some information about the identity of the perpetrator (via relevant legal channels). Maybe we can all agree to contact abuse at enom with the same information and apply a little pressure.
Some of the domains used, have already had their nameservers changed to:
BLOCKEDDUETOSPAM.PLEASECONTACTSUPPORT.COM
DUMMYSECONDARY.PLEASECONTACTSUPPORT.COM
Domains used so far, please add to the list if there are any additional in your own receipts:
cardnews.co.uk
newstorun.com
newsnationals.net
liveuknews.co.uk
onepoundnews.co.uk
rockmsockmnews.com (blocked)
bigtimenewstime.com (blocked)
originalknowledgedropper.com (blocked)
letsgetnewsie.com
newsinfowire.com
newsinyoface.com
newsenfiego.com
uknews4u.co.uk
yournewsline247.com
mynewsline247.com
ournewsline247.com
newsbuck1.com
newsbuck2.com
newsbuck3.com
newsblaze247.com
newsblaze365.com
newsfinder365.com
newsbug365.com
newsbug247.com
All (.com and .net, with visible contact addresses) registered with the same gmail contact address, suggesting the owner is quite possibly actually picking up that address.
Also, for those not receiving (and maybe I was a little hasty in suggesting that those not receiving spam need not respond) it's worth noting that my Exim logs are showing that a lot of these are being caught by SpamCop and SpamHaus, or being refused based on callbacks failing (depends on your server setup) eg:
JunkMail rejected - mx1.uknews4u.co.uk [138.128.1.73]:41524 is in an RBL, see Blocked - see http://www.spamcop.net/bl.shtml?138.128.1.73
JunkMail rejected - (newsinyoface.com) [138.128.146.20]:41466 is in an RBL, see http://www.spamhaus.org/sbl/query/SBLCSS
I've also just experienced a ridiculous situation, where I've placed a support system, support request, on an unrelated matter, and received a phone call in response. If I wanted to talk on the phone, I would have phoned in. I used the support system because I want to deal with the question in a thorough way, that can later be referenced. The first question asked by the Plus Net Business Broadband representative, was, "can you tell me your Plus Net username please?"
My response was, "I'd rather not tell you that, as you've phoned me from a withheld number..." I can't identify this person. Why would they try phoning in response to a query? But I digress.
James
(Edit for a misplaced comma)

[#8]

- Email address type:  Own email-only service through Clara, used for about 15 years
- Address unique to plusnet billing?  Only that and this forum. Never sent from. Received by the catch-all main account.
- Length of time account held with plusnet? Since 5th March 2008
- Length of time address was used with account? Always
- Address passed to third party during support? Not by me!
- Are you a Broadband Phone user? No
- Are you a CGI-Hosting platform user? No
- Has the address been used for 'status update' emails? Yes, also things like notes about the firewall changes.
I only use PN for internet access, every service I use (like email, web hosting etc), I get elsewhere.

[#9]

Quote from: HolaPussycat

Domains used so far, please add to the list if there are any additional in your own receipts: cardnews.co.uk newstorun.com newsnationals.net liveuknews.co.uk onepoundnews.co.uk rockmsockmnews.com (blocked) bigtimenewstime.com (blocked) originalknowledgedropper.com (blocked) letsgetnewsie.com newsinfowire.com newsinyoface.com newsenfiego.com uknews4u.co.uk yournewsline247.com mynewsline247.com ournewsline247.com newsbuck1.com newsbuck2.com newsbuck3.com newsblaze247.com newsblaze365.com newsfinder365.com newsbug365.com newsbug247.com

The only one I have received from that is not on that list is ukbrandnews.co.uk, again registered to Gamer SEO in New Jersey, like all the others.

[#10]

Would anyone posting here happen to be BusError on Twitter?
https://twitter.com/BusError/status/533365958405271552
If not, there's another one to add to our numbers,
James

[#11]

Note: If you do a Google search for each of those domain names (in quotes) and spam, eg:
"onepoundnews.co.uk" spam
The only results that come up are related to Plus Net.
Now, I would please like an update from Plus Net, as to exactly what it is they have done regarding this data leak, because after more than a month, it's a stretch for even Plus Net to say that it's not a leak from some point in their chain, when there is not another forum, blog, tweet or statement from anyone that mentions a different company, to whom they've given a specific identifying email address, that is receiving these very specific emails.

[#12]

Interesting: http://lmgtfy.com/?q=%22newsinyoface.com%22+spam&l=1
Look at the number of spam hosts!

[#13]

Moderators - would you please consider moving this topic in to Feedback - it should not be buried away in Other Queries.

[#14]

This morning I received an email from Plusnet "A brew, a mince pie and Plusnet. Christmas heaven...".
All of the links in the email (with one exception I've spotted) are to http://bt-plusnet.trclient.com/id=5874,18275620,126308661,574734,1?erl=https%3A%2F%2Fportal.plus.net...
I haven't had any of this spam until now, so if it starts soon...

[#15]

Quote from: jelv

I haven't had any of this spam until now, so if it starts soon...

I should think that is unlikely. Clearly a leak has happened, at a point in time. If there is an on-going leak, Plusnet is in even deeper doo-doo.