topic Re: Spam / Phishing !! in Community Site Feedback

Spam / Phishing !!

Anonymous — Fri, 26 Aug 2016 02:07:04 GMT

I've had a good look round, but I cannot find where to send the messages to Plusnet to inform them ?

Needless to say, nothing clicked on...

An example of the "New" policy of allowing anyone to post on the forum, without having a Plusnet Subscription, and totally unregulated.

And they keep on coming !!

10 more in the last 30 minutes...

How do I block this person ?

I don't want to click on "sender"

How do I delete just their messages ?

Re: Spam / Phishing !!

Mav — Fri, 26 Aug 2016 05:42:17 GMT

I received one of these messages as well. The user has now been banned so you shouldn't get any more.

Infinity's phishing thread

petlew — Fri, 26 Aug 2016 05:43:22 GMT

I tried to reply to Infinity's thread as I have had an identical PM. But for some reason the reply was rejected as "Ooop's you cannot reply to a read only thread". So I started this one separately. Perhaps a mod can merge them.

I first saw the PM on my mobile phone.

In my PC email compared to a recent real "heads up" PM notification, this PM looks entirely genuine. Needless to say I haven't opened it or the link within it.

Next step please PN?

Re: Infinity's phishing thread

Mav — Fri, 26 Aug 2016 05:49:07 GMT

Moderator's note by Mike (Mav)

Topics merged

Re: Infinity's phishing thread

petlew — Fri, 26 Aug 2016 05:50:58 GMT

Thanks Mav,

Re: Infinity's phishing thread

Mav — Fri, 26 Aug 2016 05:51:26 GMT

@petlew

You probably posted just after I moved the thread.

Re: Infinity's phishing thread

petlew — Fri, 26 Aug 2016 05:58:30 GMT

Just to collaborate with infinity. Shouldn't there be a PN link somewhere to forward this type of phishing email for investigation. Many other organisations have them (mostly banks etc.)

Or is there one already and we just can't find it?

Re: Infinity's phishing thread

Mav — Fri, 26 Aug 2016 06:05:55 GMT

There is a Report to Moderator button but that is only available once you enter a PM.

Re: Infinity's phishing thread

Anonymous — Fri, 26 Aug 2016 06:26:13 GMT

I got two of these this morning, and I used the Report to Mod button on the message view page. I saw from the email notifications that there was no dodgy looking content and as there was no other way to report them I had to use that option as at that point I didn't know there was a thread regarding them.

Re: Spam / Phishing !!

chuffchuff — Fri, 26 Aug 2016 06:52:50 GMT

As a fellow recepient of one of these I am curious as to why someone who is not a Plusnet subscriber can post?

I was not even aware of the option to do this nor had I ever considered it a possibility.

When was this made available to non PlusNet folk?

Re: Spam / Phishing !!

Anonymous — Fri, 26 Aug 2016 06:58:22 GMT

It was part of the move to the new forum, one that annoyed a lot users. But at the time we were advised that this was the way it would be and could not be changed. So we are stuck with it.

Re: Spam / Phishing !!

Anonymous — Fri, 26 Aug 2016 07:09:25 GMT

With the advent of the PM spam can I suggest (maybe to @jaread83) that a captcha be added to the form, but if that can’t be done then limiting the number of recipients of a message to about 5, to minimise the impact of a determined sender.

The captcha doesn’t have to be elaborate, even a home grown plugin that requires some basic arithmetic would suffice, indeed anything that prevents the automation of the process. Another option maybe to disable the auto lookup of usernames again to limit the impact.

I don’t think genuine message senders would have an issue with this but as I can’t answer for anyone but myself it may be worth while finding the consensus.

Re: Spam / Phishing !!

jaread83 — Fri, 26 Aug 2016 07:42:43 GMT

Hi Mook, that is a great suggestion and upon inspecting the admin panel, it looks like there is a way to display a word challenge after X amount of messages are sent per minute. This is part of the system and we haven't enabled it (but that is all going to change after this revelation). We have a couple of options:

What I can do is set the private messaging to be 1 message per minute and any concurrent messages sent within that timeframe will require a captcha challenge.

A secondary option we could go with is that we can have the captcha enabled for a specific user group (i.e low rank users) so we could have the captcha enabled for the lower ranks like freshly registered users and the rank that only have a couple of posts.

Whatever option we go with, I beleive it will put a stop to this type of thing happening again.

@HarryB, @MattyC and @Chris - what would you like me to do with this?

Re: Spam / Phishing !!

Anonymous — Fri, 26 Aug 2016 07:49:21 GMT

Well my 10p's worth is to captcha the lower ranks, as that is a best fit as I see it, as it doesn't hinder the seasoned or 'old hack' forum users. But to be honest a message count of +10/15 would be my thinking.

Re: Spam / Phishing !!

Anonymous — Fri, 26 Aug 2016 08:03:26 GMT

In total I must have received around 15 of the same message, spaced out to be one every few minutes.....

Possibly as they skipped from person to person ?

I use Apple Mail, and all the PN message notifications go there.

After the first five of the same, I set up a Rule within Mail, it took me all of 10 seconds, and Blocked & Deleted all previous & future notifications of messages from this person.

I didn't need to open any messages, options include "from" "subject ie Notification of message from ..." etc. Very comprehensive & quick

Something similar here would be nice !

We should be able to report Spam / Phishing messages without opening them....

I fear we will get more of the same.

On the old system, we could stop / start receiving messages, is that possible here ?

And how do you delete selected messages on this system, I could only delete all !

Re: Spam / Phishing !!

Minivanman — Fri, 26 Aug 2016 08:05:11 GMT

Banned so no more you say? I've had several of these with the last one being an hour ago. Not complaining, just saying.

Re: Spam / Phishing !!

jaread83 — Fri, 26 Aug 2016 08:09:15 GMT

It looks like permissions are based on roles (members, admins, mods, veterans) rather than rank.

I will be applying the captcha to all normal members and will display the captcha after two messages are sent within a minute. There are some other configurations I need to go through so I will update you all when this has been done.

Re: Spam / Phishing !!

chuffchuff — Fri, 26 Aug 2016 08:09:54 GMT

Totally agree!

Separately, is there anything else that was included in the change over to the new forum that could allow the unwanted to irritate?

Forewarned is forearmed.

I am actually quite shocked to have received a spam message via a forum that I had (hitherto) held in good regard.

Disappointing, to say the least!

Re: Spam / Phishing !!

petlew — Fri, 26 Aug 2016 08:20:36 GMT

Well done jaread83, and reasonably quick off the mark as well.

Personally I would have no problem with a Captcha in use for all members. I would suggest though that members check their email first before logging on to PN, that was my first view of this one.

The one place I haven't deleted it yet is from my PM folder, I agree with Infinity there doesn't seem to be a way to delete a single PM. And if there was, how effective is PN's deletion security.

Re: Spam / Phishing !!

Minivanman — Fri, 26 Aug 2016 08:21:18 GMT

I can quite honestly say that this is the first forum where I have received spam as a private message. Just lucky maybe?