topic Re: Pop-up and surveys in Community Announcements

Pop-up and surveys

MattyC — Thu, 05 Feb 2015 13:47:35 GMT

Hi all,
We've seen a couple of people recently reporting that they've had pop-ups or webpages asking them to enter in to a survey regarding the Plusnet service. These surveys are offering an incentive to fill them in and occassionally ask you to enter payment details or to make a small payment prior to receiving the incentive.
These surveys are not from Plusnet. Please do not fill them in and if you do see them, we'd suggest closing the web page they are showing on and run an anti-virus and malware scan on your computer(s).
From our side we've taken steps to identify and mitigate the possibility that you'll see this survey by working with our security team.
If you do see this, or anything suspicious that reports to be from Plusnet, please report this to us so we can investigate.
In most instances, communications from Plusnet are via email (to the address on your account) and can be seen on your account at https://contactus.plus.net
Thank you for reporting these to us and please continue to do so.

EDIT: What it'll look like

Re: Pop-up and surveys

jelv — Thu, 05 Feb 2015 13:52:07 GMT

Are they the same as the ones AAISP is reporting? http://wiki.aa.org.uk/Mystery_Popups

Re: Pop-up and surveys

Chris — Thu, 05 Feb 2015 13:57:01 GMT

It would appear to be very similar, yes.

Re: Pop-up and surveys

Anotherone — Thu, 04 Jun 2015 12:54:53 GMT

Just stumbled across this, surely this sort of issue should have been put on Announcements or even Feedback where it would have been more prominent and could even have been "stickyed"

Re: Pop-up and surveys

Kremmen — Thu, 04 Jun 2015 13:03:47 GMT

Thanks for the heads up.
If I'd been asked for a contribution then that would be end of my survey. I won't even entertain these companies that want a credit card number for a free trial.

Re: Pop-up and surveys

Strat — Thu, 04 Jun 2015 21:23:33 GMT

I came across one of these 'PN' survey popups while cleaning up my grandson's laptop yesterday...they are also Plusnet customers.
I ran Kaspersky and Malwarebytes....lots of PUPs were found.

Re: Pop-up and surveys

Iamagnome — Sat, 04 Jul 2015 14:04:16 GMT

hopefully this works... a pic of what the webpage looks like... it would help others to know what it looks like
See attachment

Re: Pop-up and surveys

Anotherone — Sat, 04 Jul 2015 14:50:05 GMT

Hi there Iamagnome. Welcome to the forum.
Thanks for that screen grab, I'm sure many of us will now know what to watch out for.

Re: Pop-up and surveys

lorisarvendu — Wed, 08 Jul 2015 12:55:20 GMT

I've noticed two things about these (I've had a few recently).
1. They pop up while I'm on Facebook.
2. They seem to be targeted at known PN IP address ranges.
As luck would have it I'm at work, but I've configured one of my browsers to use my home connection as a web proxy. There isn't a dodgy reason for this - I work in IT and sometimes we get reports of web pages being blocked by our firewall, so I test them out using a vpn. Anyway, the page that displays - http://www.2015-isp-surveys.com/ - doesn't have any content on it's own, but seems to be activated by a pop-up from within Facebook. A pop-up that seems to know that I am browsing from a Plusnet IP address.

Re: Pop-up and surveys

Biscayne — Tue, 14 Jul 2015 16:27:47 GMT

Hi, I had the popup similar to the one posted by Iamagnome yesterday. It came from www_dot_consumers-survey-group_dot_com (_dot_ substituted for . to prevent a hyperlink) via www_dot_boreburn_dot_com via www_dot_express_dot_co_dot_uk
Quite clever, their server must perform an automatic lookup of the source ip address so that they can present the name of the ISP. One thing that alerted me was that the name given was "Plusnet Technologies Ltd" and not "Plusnet plc".
consumers-survey-group is registered to Whois Privacy Corp, in the Bahamas. I suspect that privacy is the last thing they deal in. A quick search suggests it to be a scam to get card details.
I have added consumers-survey-group to my router's blocked site list.
Maybe Plusnet would consider blocking the site for all it's customers as it could be quite convincing to those less paranoid than myself!

Re: Pop-up and surveys

Anotherone — Tue, 14 Jul 2015 16:40:16 GMT

Hi Biscayne, welcome to the forum.
That's such a brilliant suggestion about blocking the site, Plusnet are bound to implement it. Just like all the other brilliant suggestions we give them get implemented ... not

Re: Pop-up and surveys

Biscayne — Tue, 14 Jul 2015 21:10:38 GMT

Hi Anotherone, oh, it looks like I have a bit to learn about PN then :-[.

Re: Pop-up and surveys

Anotherone — Tue, 14 Jul 2015 21:30:03 GMT

I'm afraid I'm being a bit of a cynic at present, have a good read of the threads on the Feedback board and you'll get the idea. Things ain't what they used to be, but not as bad as TalkTalk or BT (yet). But you never know, your suggestion is one that may get looked at if the right people see it.
Anyway you'll usually find plenty of help here on the forum if you need it

Re: Pop-up and surveys

MattyC — Wed, 15 Jul 2015 08:37:08 GMT

Hmmmm, when I first set up this thread, the pop ups were a little less prominent than they are now.
For now, I have updated the post with a picture of the survey. Will speak with QA about an ISP level block, though it may be a case a fighting for the dev time.
Matty

Re: Pop-up and surveys

gofaster — Wed, 15 Jul 2015 16:30:22 GMT

Yep - got to keep those developers focused on the high priority issues - like removing the High Speed Broadband link

Re: Pop-up and surveys

Anotherone — Wed, 15 Jul 2015 22:50:10 GMT

You hit the nail on the head

Re: Pop-up and surveys

MattyC — Thu, 16 Jul 2015 07:58:33 GMT

Appreciate the frustration, but probably best to air it in the other thread open re: the high speed broadband link.

Re: Pop-up and surveys

AndyH — Thu, 16 Jul 2015 11:01:23 GMT

Other ISPs also affected - http://www.revk.uk/2015/07/more-scum.html

Re: Pop-up and surveys

lorisarvendu — Tue, 28 Jul 2015 07:02:57 GMT

The plot thickens. We had a warning mail sent around at work about Survey pop-ups that were purporting to come from a company called Zendesk, who provide our online ticket management system. They look suspiciously familiar (i have blurred out the first part of the address, but that is our actually our zendesk link there. I'd be very interested to know how they're doing this.

Re: Pop-up and surveys

ScottStorey — Tue, 28 Jul 2015 07:52:50 GMT

It will either be malware or a browser extension installed locally on your machine that will have brought it down. The annoying sort of extensions that ask to be installed as part of a legitimate program halfway through so are easy to click accept on. I've not seen a variant yet that works in a different way.
They scrape the page for keywords and generally use the page title to populate where you are seeing about zendesk. A similar method is used for where it shows your ISP, I believe it checks whois records to get the company name. I can't say I've checked, but that's how I would do it.
It is unfortunate there is a legitimate survey campaign happening while these pop ups seem to be increasing in number again!
The issue with an ISP level block (which is in principle a good idea BTW) is that if the signatures are not good enough we could end up blocking legitimate traffic. There are also lots of variants using different URLs so blocking all of them becomes impractical.
Personally, I think the best thing we can do in these sort of scenarios is help to educate people.
Would a blog post on how to avoid and remove these sorts of things interest people?
If so, I can have a word with the guys about getting something written when something widespread like this is going on as long as it fits in with their plans for the blogs.