topic Re: Email being used for spam? in Email

Email being used for spam?

jerryw — Tue, 23 May 2023 11:23:55 GMT

A little wihle ago I received an automated email from Plusnet that said, inter alia:

"During Monitoring of our platform, we noticed a number of emails are being sent from a remote or local IP address using one of your mailbox login credentials.
These mails were identified as unsolicited by our spam filtering software and were brought to our attention, we then sanity checked the source IP address, Subject Line, the From and To addresses and content. Based on these factors, we believe its quite possible your mailbox log-in credentials have been compromised.
For reference, the mailbox in question is: (something I don't recognise).

I am pretty certain this is not relating to my current contract, but to a previous one, possibly a very old one indeed. There have been several, over the years. But as usual the email cannot be responded to, and I don't seem to have any way to find out the specific account in question... is it possible that some kind plusnet soul could supply an account username or some other id that distinguishes it for me? Or other suggestion?

I hate spam with a passion and when I rule the world, all perpetrators will be tracked down and will have to pay in perpetuity for everyone else's broadband access ...

Re: Email being used for spam?

Champnet — Tue, 23 May 2023 11:31:28 GMT

You Sure it’s from Plusnet ?
There’s some ‘unusual phrasing‘ in the message with no actual details which I’d expect to see….

Re: Email being used for spam?

jerryw — Tue, 23 May 2023 14:58:53 GMT

Yeah, pretty confident. Here is the rest of the email:

"The most probable reason is an insecure or weak password, possibly plain text which could have been obtained by a local virus/keylogger or brute-forced using normal dictionary words.

We suggest you now perform an audit of all passwords and sensitive information that may have been accessible from keyloggers etc and perform a full security audit & Virus/malware scan of any Pc's connected to your network.

Once you have taken action, please contact us to arrange for a new strong (cryptic) password to be applied to your mailbox, please use upper / lower case characters and numbers or special characters mixed.

Alternatively, if you are confident you have secured all your local network/computers, you can update your account password with a more secure cryptic password via your customer portal. http://email.plus.net

Please note once you make these changes you will need to update any mail software which uses the password your changing to reflect the new password. If the password you are changing is your default password for your account and if you use our broadband service and you are not using a Plusnet supplied router, You will need to update the authentication details in your broadband router configuration to reflect the changes made.

Before making these changes we recommend you familiarise yourself with Plusnet supplied routers here:- http://www.plus.net/support/broadband/hardware/
If you are unsure how to change your email configuration, please see our help guides here:- http://www.plus.net/support/email/index.shtml
An overview of how to manage your mailboxes is available here:- https://portal.plus.net/support/email/mmm_overview.shtml

If you require support on this matter or any other, please do not hesitate to contact us. https://www.plus.net/home-broadband/contact/

Thanks for your co-operation.

Kind Regards,

Plusnet Abuse Team

This email has been sent as it contains important information about your service from Plusnet. Please do not reply to this email, as this is an unmonitored address.

PlusNet PLC Registered Office: The Balance, 2 Pinfold Street, Sheffield, S1 2GU. Registered in England no: 3279013"

... it has all the usual elements of superficially helpful but actually impenetrable advice that Plusnet loves to provide

Re: Email being used for spam?

willcutforth — Tue, 23 May 2023 16:59:30 GMT

Howdy partner!

That is definitely one of our sneaky emails! It should say the username at the top of it though! Do you have that at all?

Re: Email being used for spam?

jerryw — Tue, 23 May 2023 17:21:15 GMT

Well no, or I wouldn't be asking for it!!

You have all of the email, apart from the failed mailbox name...

Oh well, I won't stress over it. But it wasn't a helpful email

Re: Email being used for spam?

Townman — Wed, 24 May 2023 13:20:56 GMT

Had on of these recently myself...

The fact that you did not recognise something does not make the email unhelpful entirely. It might remind you of something from history which you use no longer ... and possibly should ask to be closed down.

The key piece of information is...

For reference, the mailbox in question is: AccountName

For reference, the mailbox in question is: AccountName+MailboxName (mailboxname@accountname.plus.com - or @yourhosteddomain.co.uk)

The email will have been sent to postmaster@AccountName.plus.com

Given that you report the receipt of this email, then you must still be using the email service associated with AccountName.

The email advises that the password has been reset on the mailbox:

If the format was just AccountName then that means that the main account password was reset and you will not be able to log into the user centre anymore - that will also have reset the internet connection password if such a service is still being delivered on AccountName
If the format was AccountName+MailboxName then just the password on that mailbox was reset

The following might be helpful...

Reset email password

If you are not able to login to the email address using webmail, then it is likely that your email address has been identified as being compromised and has had its password changed. Where email address passwords have been changed to protect the integrity of the service, the Plusnet account password is left unchanged.

Which ISP are you with, Plusnet or one of the other / legacy vISPs?

Plusnet / Force9 / FreeOnline users can only change the password on the DEFAULT email address by changing the password on the user ACCOUNT through the user portal. You can change the password on a secondary mailbox using the Manage My Mail options in the user portal.

Brightview users (Madasafish / FreeNetName / GlobalNet / IC24 / ICScotland / Dialstart / Totalise) logging into webmail should use their full email address. Use the MAAF user portal to update the password on the default email address (change the account password) and use this MAAF guide to change the password on a secondary mailbox address. If you cannot recall the account password, you will need to contact support ... because the account password change process sends an email to the mailbox you cannot now access.

DO NOT USE THE SAME PASSWORD AGAIN for that would allow the continued exploitation of the account. The new password should be cryptic and not one used before.

Note that changing the account password will change the password used for logging on to the relevant user portal. If your email service is NOT a retained legacy service (one associated with a retired internet service account), then the password required by the router to connect to the internet will be changed too. If the router is a Hub Zero or a Hub One supplied by Plusnet it should update automatically. If not, you will need to log into the router, drop the connection, change the password yourself and reconnect.

On the assumption that the email address password has been compromised, I strongly recommend that wherever you have used that email address / password combination as access credentials to services such as Amazon, Netflix, eBay etc., that you also change the passwords on those service as well.

Re: Email being used for spam?

jerryw — Thu, 25 May 2023 10:43:17 GMT

No .. the email was sent to "oldplusnetac@(my domain) ."

The format was the second of the two options you give but the account name part (they could usefully have mentioned that is what it was!) I do not recognise, and could not log into.

Never mind. i will try phoning them, when I am feeling strong

Re: Email being used for spam?

Gandalf — Mon, 29 May 2023 15:02:12 GMT

@jerryw Are you attempting to log-in using just the AccountName as the username rather than AccountName+MailboxName? If so, see if you can do a password reset here and try again.

Re: Email being used for spam?

jerryw — Mon, 29 May 2023 15:05:34 GMT

Bless you, a friendly voice from the past 🙂 .. do hope all is well your end.

In the end I did manage to log in - but I can't do anything, it says there is already a change in progress and I am barred from everything.. no data .. it is quite an old account.

Re: Email being used for spam?

Gandalf — Mon, 29 May 2023 15:20:55 GMT

Hi @jerryw

I'm very good thank you, I hope you are as well.

I can't fix that error message in these instances, but there isn't much to do anyway, apart from managing the email settings. Out of curiosity, does the direct link here let you in to the manage my mail part?

Re: Email being used for spam?

jerryw — Mon, 29 May 2023 15:32:28 GMT

It DOES, yes ... interesting page, not seen that before!

But it doesn't really help because it is an old account I no longer have anything to do with, and according to plusnet it was misused for spam or something .. what i would really like to do is to wipe the whole account and have it completely deleted.. not doing me or Plusnet anything useful now.

It wouldn't surprise me if Plusnet have quite the number of old accounts knocking around that should be purged.

Re: Email being used for spam?

Gandalf — Mon, 29 May 2023 16:15:41 GMT

Ah okay, I’d suggest calling the cancellations team on 0800 013 2632 quoting that username and they should be able to cancel the account for you.

Let me know if there are any issues.