topic Re: Please Help me stop unwanted emails in Email

Please Help me stop unwanted emails

Katie222 — Sun, 05 Apr 2026 16:45:12 GMT

Foe weeks I have been getting 20-24 emails a day purporting to be sent by my own Plusnet email address.
If I can give you the gist of how they start -
the heading is YOU PERVERT, I RECORDED YOU!

- Hello! Unfortunately, there is some bad news for you.

Some time ago, your device was infected with my private Trojan, R.A.T (Remote Administration Tool).

If you want to find out more about it, simply use Google.

My Trojan allowed me to access your files, accounts, and your camera.

There is more but as an elderly lady I am embarrassed enough without repeating it here.
I have read that I can be scammed by someone using my own email address and have changed my password and reported it as phishing but they still arrive hour after hour.
Please advise me on what to do. Katie

Re: Please Help me stop unwanted emails

jab1 — Sun, 05 Apr 2026 17:07:27 GMT

@Katie222 Sadly, this kind of thing happens from time to time. They may appear to come from your own address, but if you check the name in the angled brackets '<someone@somewhere.com>, they are sent using your name, but not actually from your email.

Sorry you have been plagued for so long, but they will stop eventually.

All you can realistically do is delete them unread.

Re: Please Help me stop unwanted emails

pvmb — Sun, 05 Apr 2026 17:12:22 GMT

Katie222

Don't worry!

Could they have infiltrated your computer or email account? Possibly. But it is at least (if not more) likely it is just a bluff. They do obviously know your Plusnet email address, which they are spoofing (this is not difficult to do) when emailing you. They are trying a typical email blackmailing scam on you (and probably many others).

https://www.ncsc.gov.uk/files/sextortion-scams-infographic.pdf

As a first step, and precaution, it would be best to try and change your account passwords. Advice can be found in the above link.

Strong passwords are LONG. One known way of generating easy to remember ones is to use three random words. e.g. SugarRatClock, a number at the end could indicate the year first used: SugarRatClock26.

Never be tempted to make ANY response of any kind to the sender - not even to any 'Click here if you do not want to receive any further emails' - unless it is not Spam but advertising etc. from a genuine supplier you have a relationship with.

There are more sophisticated (but technical) ways of tackling the issue if it persists

Re: Please Help me stop unwanted emails

Champnet — Sun, 05 Apr 2026 17:53:36 GMT

@Katie222 I've been getting the same email regularly over the past few weeks, they are an embarrassing nuisance. I don't use a Plusnet email address so they are not coming through the Plusnet system. They are originating from someone using a Russian service. I suspect our email address' have been harvested from an online business using a not-so secure security system. Nothing to worry about and they will eventually stop but if it makes you feel better change your password.........

Re: Please Help me stop unwanted emails

Katie222 — Sun, 05 Apr 2026 17:57:56 GMT

Thanks John, it helps to know that they will stop eventually.
I do delete them as I hate to just look at them.

Regards, Katie

Re: Please Help me stop unwanted emails

Katie222 — Sun, 05 Apr 2026 18:02:39 GMT

Thank you for your comments and advice.
I do have security on my system and did change my passwords and I'm sure that I have not been infiltrated.
I never reply to emails or click on anything but this one has got me beat.
I just hope that they get fed up and go away.

Regards, Katie

Re: Please Help me stop unwanted emails

Katie222 — Sun, 05 Apr 2026 18:06:35 GMT

Thank you for your reply and sorry that you are also getting these offensive mails.

I did change my email but they lost carry on. I hope they stop soon for us both.

Regards, Katie

Re: Please Help me stop unwanted emails

kenm — Mon, 06 Apr 2026 08:08:22 GMT

I also have been plaqued for weeks with exactly the same email.

I am with Greenby since Dec25 when first started have put all the senders into Block/Blacklist

have complained to Greenby have upped scam filter to no2 NO USE

Today i have received 4 emails all showing to have come from my own full email address

Greenby just says i have been spoofed and not to worry

I changed my password a while back when getting about 10 per day

Can only hope they dissapear soon

KenM

Re: Please Help me stop unwanted emails

Digsy — Mon, 06 Apr 2026 14:01:32 GMT

I'm getting these too - maybe three or four a day. They seem to arrive in batches. I honestly wish I had the stamina that this scammer is implying

Here is the full header from one of them. The sending IP address seems to change every time.

Return-path: <my plusnet email>
Envelope-to: my plusnet email
Delivery-date: Mon, 06 Apr 2026 14:43:24 +0100
Received: from [84.93.230.243] (helo=avasin-ptp-007.plus.net)
by inmx-peh-007.plus.net with esmtp (PlusNet MXCore v2.00) id 1w9kEe-000BI3-Rv
for my plusnet email; Mon, 06 Apr 2026 14:43:24 +0100
Received: from mail.enmail.co ([91.204.208.8])
by Plusnet Cloudmark Gateway with ESMTP
id 9kEWwW4t9l3NF9kEWwe3jG; Mon, 06 Apr 2026 14:43:16 +0100
X-CM-Score: 100.00
X-CNFS-Analysis: v=2.4 cv=O4iavw9W c=1 sm=1 tr=0 ts=69d3b874
p=xuSakxmQ/AEa0MmB+nwSGURWKu8=:19 p=NX+gl+Xpg2tz9MSno0cNtH3+2FI=:19
p=bU8HyK+u2KSFcGbJwLAM7afV7Pw=:19 p=gve5RamNw6ExUc_rcJwu:22
a=/50HAxhVri9f9h8qkinWjQ==:117 a=DcbIDYK6h3DEYZsrSIB62w==:17
a=A5OVakUREuEA:10 a=tQgp67HcAAAA:8 a=lxoXj2O9AAAA:8 a=5TAOmqheAAAA:8
a=es68Ls6DAAAA:8 a=n_qX3DqFkvG4QMFIzRAA:9 a=7zbRnxVGAaKOODsWIkmG:22
Received: from [192.223.121.215] (unknown [192.223.121.215])
by mail.enmail.co (Postfix) with ESMTP id 4CA4AC030D
for <my plusnet email>; Mon, 6 Apr 2026 13:43:14 +0000 (UTC)
Authentication-Results: mail.enmail.co;
dkim=none;
spf=softfail (mail.enmail.co: 192.223.121.215 is neither permitted nor denied by domain of my plusnet email) smtp.mailfrom=my plusnet email;
dmarc=fail reason="No valid SPF, No valid DKIM" header.from=plus.com (policy=none)
Received: from agcafwa ([193.29.43.234]) by 15025.com with MailEnable ESMTP; Mon, 6 Apr 2026 09:43:18 -0400
Received: (qmail 18754 invoked by uid 187); 6 Apr 2026 09:43:16 -0400
From: my plusnet email
To: my plusnet email
Date: Mon, 6 Apr 2026 09:43:18 -0400
Message-ID: <187540.187540@15025.com>
Mime-Version: 1.0
Content-type: text/plain;
X-Spamd-Result: default: False [9.94 / 4.00];
VIOLATED_DIRECT_SPF(3.50)[];
BAYES_SPAM(2.24)[90.20%];
SUBJ_ALL_CAPS(2.10)[28];
CT_EXTRA_SEMI(1.00)[];
R_MISSING_CHARSET(0.50)[];
MV_CASE(0.50)[];
MIME_GOOD(-0.10)[text/plain];
DMARC_POLICY_SOFTFAIL(0.10)[plus.com : No valid SPF, No valid DKIM,none];
RCVD_NO_TLS_LAST(0.10)[];
ASN(0.00)[asn:26210, ipnet:192.223.121.0/24, country:BO];
FROM_NO_DN(0.00)[];
RCVD_COUNT_ONE(0.00)[1];
MIME_TRACE(0.00)[0:+];
TO_EQ_FROM(0.00)[];
RCPT_COUNT_ONE(0.00)[1];
R_DKIM_NA(0.00)[];
MISSING_XM_UA(0.00)[];
NEURAL_SPAM(0.00)[1.000];
FROM_EQ_ENVFROM(0.00)[];
FUZZY_RATELIMITED(0.00)[rspamd.com];
R_SPF_SOFTFAIL(0.00)[~all];
TO_MATCH_ENVRCPT_ALL(0.00)[];
TO_DN_NONE(0.00)[];
BITCOIN_ADDR(0.00)[17EZaSdSndsyuQC8xJxarrFse19QiDdFQJ];
ARC_NA(0.00)[]
X-Spam: Yes
X-CMAE-Envelope: MS4xfHX07u45pxJqgsRF89PueXNfMy7vtEDn0P8+Mx3PgzsmQIUJojRbxOBJv4Q0WRQWwTO3Y4GCp3Nr8ZfCXTstJss5hvZdOsLfel9lp+y/U12jvMG+RU0K
5jgexqFPjzZ+uHRMWgjF3hPVqVbxeuQ3Twq1XTxm7wWBrmHPiax90LpHsbIbD43IKesLuD83/O6taCZttJ8yWQRQqCOnghvT4exBlh9FD4UKxqXFQow4EnPp
X-pn-pstn-db:" Spam 99
X-PN-Virus-Filtered: by PlusNet MXCore (v5.00)
X-PN-Spam-Filtered: by PlusNet MXCore (v5.00)
Subject: YOU PERVERT, I RECORDED YOU!

Re: Please Help me stop unwanted emails

pvmb — Mon, 06 Apr 2026 14:11:42 GMT

"Received: from agcafwa ([193.29.43.234]) by 15025.com with MailEnable ESMTP; Mon, 6 Apr 2026 09:43:18 -0400"

Is the above the IP address that keeps changing? The given one is listed as for domain vector.com registered in Stuttgart.

inetnum: 193.29.43.0 - 193.29.43.255
netname: DE-VECTOR-193-29-43_24
descr: Vector Informatik GmbH 2. PI (ehm. TESIS GmbH)
country: DE

% Abuse contact for '193.29.43.0 - 193.29.43.255' is 'VI_Domainadm@vector.com'

Re: Please Help me stop unwanted emails

Champnet — Mon, 06 Apr 2026 14:42:31 GMT

I've had 3 this morning :

77.183.185.139 Germany
5.251.37.154 Kazakhstan
5.251.37.154 Kazakhstan

Re: Please Help me stop unwanted emails

Marksfish — Mon, 06 Apr 2026 15:42:24 GMT

Spoofing is a fact of life these days unfortunately 🙁. I don't use PN email, but have tried everything to prevent my domain being used. Sometimes I get 30 or 40 at a time. My worst was 200 in a day, all using my email as a reply to, none sent through the email server. Luckily, Mailwasher stopped me having to download them all. I thought there was a way for the email records to be changed so that an email can't be sent with a false domain, but it seems not.

The list you are on will be exhausted soon and it should settle down. Hopefully it doesn't happen too often.

Re: Please Help me stop unwanted emails

Mav — Mon, 06 Apr 2026 16:03:31 GMT

It's been a long time since I had any of these 'I know what you've been doing'-type emails.

The laughable thing was wanting money or they would email webcam footage to family and friends. At the time I didn't even have a webcam.

As others have said, ignore and delete them. They prey on the vulnerable and hope that out of the thousands they send a few will comply.

Re: Please Help me stop unwanted emails

Champnet — Mon, 06 Apr 2026 16:56:21 GMT

Statistically 0.07% of recipients will respond positively.

Re: Please Help me stop unwanted emails

Digsy — Tue, 07 Apr 2026 09:30:05 GMT

I've got four more this morning. Which line in the header would be most relevant for the IP of the server it was actually sent from?

P.S. I'm not worried about this in the slightest, it's not exactly the first time it's happened. But the frequency of these mails is a trifle annoying, especially as I get them on my mobile.

What is more annoying is that they are so obviously spam, I would have expected them to be filtered at the PlusNet end...

Re: Please Help me stop unwanted emails

Champnet — Tue, 07 Apr 2026 09:39:29 GMT

@Digsy Can you block on the contents of the Subject line as the sending IP varies on eaeh email.

Today I've received :

07/04 05:45 126.52.131.47 Japan
07/04 06:38 88.188.201.98 France
07/04 06:39 2.79.111.129 Kazakhstan
07/04 07:26 199.174.48.246 USA

Re: Please Help me stop unwanted emails

shark50 — Tue, 07 Apr 2026 09:51:37 GMT

I'm currently getting about a 100 of these spoofed emails per hour!!

Luckily they all end up in the SPAM bucket, so it's a battle of wills between me getting bored or him getting bored first, but he's not getting a penny from me.

I've checked the full email headers and they change almost every time.

Return-Path: <myemail@plus.net>
Delivered-To: myemail@plus.net
Received: from dovecot-director-2.dovecot-director.enmail-prod.svc.cluster.local ([192.168.59.8])
by dovecot-9.dovecot.enmail-prod.svc.cluster.local with LMTP
id uK7xOKnG1GmsoQcAnHNXmw
(envelope-from <myemail@plus.net>)
for <myemail@plus.net>; Tue, 07 Apr 2026 08:56:09 +0000
Received: from mail.enmail.co ([192.168.118.137])
by dovecot-director-2.dovecot-director.enmail-prod.svc.cluster.local with LMTP
id 0J52OKnG1GkNHQEABAqjjQ
(envelope-from <myemail@plus.net>)
for <myemail@plus.net>; Tue, 07 Apr 2026 08:56:09 +0000
Received: from [103.247.52.254] (unknown [139.5.7.3])
by mail.enmail.co (Postfix) with ESMTP id 5A60DC02C7
for <myemail@plus.net>; Tue, 7 Apr 2026 08:56:07 +0000 (UTC)
Authentication-Results: mail.enmail.co;
dkim=none;
spf=softfail (mail.enmail.co: 139.5.7.3 is neither permitted nor denied by domain of myemail@plus.net) smtp.mailfrom=myemail@plus.net;
dmarc=fail reason="No valid SPF, No valid DKIM" header.from=plus.com (policy=none)
Received: from ivlfsvf ([131.210.209.120]) by 66220.com with MailEnable ESMTP; Tue, 7 Apr 2026 14:25:56 +0530
Received: (qmail 00596 invoked by uid 005); 7 Apr 2026 14:25:54 +0530

Return-Path: <myemail@plus.net>
Delivered-To: myemail@plus.net
Received: from dovecot-director-4.dovecot-director.enmail-prod.svc.cluster.local ([192.168.35.93])
by dovecot-9.dovecot.enmail-prod.svc.cluster.local with LMTP
id gP5cFXzJ1GmMzwcAnHNXmw
(envelope-from <myemail@plus.net>)
for <myemail@plus.net>; Tue, 07 Apr 2026 09:08:12 +0000
Received: from mail.enmail.co ([192.168.118.145])
by dovecot-director-4.dovecot-director.enmail-prod.svc.cluster.local with LMTP
id SMgvFXzJ1GnM6jgACykUkg
(envelope-from <myemail@plus.net>)
for <myemail@plus.net>; Tue, 07 Apr 2026 09:08:12 +0000
Received: from [197.211.52.72] (unknown [197.211.52.254])
by mail.enmail.co (Postfix) with ESMTP id EA60A120138
for <myemail@plus.net>; Tue, 7 Apr 2026 09:08:09 +0000 (UTC)
Authentication-Results: mail.enmail.co;
dkim=none;
spf=softfail (mail.enmail.co: 197.211.52.254 is neither permitted nor denied by domain of myemail@plus.net) smtp.mailfrom=myemail@plus.net;
dmarc=fail reason="No valid SPF, No valid DKIM" header.from=plus.com (policy=none)
Received: from zwigxke ([209.249.146.152]) by 34759.com with MailEnable ESMTP; Sat, 2 Feb 2002 01:04:30 +0100
Received: (qmail 38489 invoked by uid 384); 2 Feb 2002 01:04:28 +0100

Return-Path: <myemail@plus.net>
Delivered-To: myemail@plus.net
Received: from dovecot-director-1.dovecot-director.enmail-prod.svc.cluster.local ([192.168.222.96])
by dovecot-9.dovecot.enmail-prod.svc.cluster.local with LMTP
id eENNEFXM1GmMzwcAnHNXmw
(envelope-from <myemail@plus.net>)
for <myemail@plus.net>; Tue, 07 Apr 2026 09:20:21 +0000
Received: from mail.enmail.co ([192.168.65.54])
by dovecot-director-1.dovecot-director.enmail-prod.svc.cluster.local with LMTP
id UA4gGEPM1GkEIBUAOi1KhQ:T19
(envelope-from <myemail@plus.net>)
for <myemail@plus.net>; Tue, 07 Apr 2026 09:20:21 +0000
Received: from [212.241.16.138] (unknown [212.241.16.138])
by mail.enmail.co (Postfix) with ESMTP id E57B6C03F8
for <myemail@plus.net>; Tue, 7 Apr 2026 09:20:18 +0000 (UTC)
Authentication-Results: mail.enmail.co;
dkim=none;
spf=softfail (mail.enmail.co: 212.241.16.138 is neither permitted nor denied by domain of myemail@plus.net) smtp.mailfrom=myemail@plus.net;
dmarc=fail reason="No valid SPF, No valid DKIM" header.from=plus.com (policy=none)
Received: from bkvdgnf ([144.55.29.29]) by 59347.com with MailEnable ESMTP; Tue, 7 Apr 2026 15:20:30 +0300
Received: (qmail 50493 invoked by uid 504); 7 Apr 2026 15:20:27 +0300
From: myemail@plus.net

My wife is getting them too, just not at the same rate.

Deep joy

Re: Please Help me stop unwanted emails

Digsy — Tue, 07 Apr 2026 16:24:45 GMT

@Champnet wrote:

@Digsy Can you block on the contents of the Subject line as the sending IP varies on each email.

I could, if the PN spam filter gave me that option, as the subject line is always the same.

I did have my spam filter sensitivity set to 1 (the lowest setting) so I shall start increasing it one notch at a time to see it makes any diiference.

Mind you with a PN spam rating already at 99 you have to wonder why these are getting through in the first place.

Re: Please Help me stop unwanted emails

geoffers — Wed, 08 Apr 2026 07:51:11 GMT

I've been getting 20 or so a day too - only since Plusnet email migrated to Grennby

Mine are Received: from [213.230.92.48] <<<< This is Hostname: 48.64.uzpak.uz a service provider in Uzbekistan

Luckily they go into the spam email box, but also do some valid emails so have to keep deleting the pervert ones to see the non-spam emails

Re: Please Help me stop unwanted emails

Mad_Moggies — Wed, 08 Apr 2026 15:04:07 GMT

I've been getting the same since this weekend just gone. The first couple of batches were from a named person but the remainder have been sent as though from me, but obviously the address has been spoofed.

I'm fed up with them too, and incidentally I'm a 75 yrs old female, but I'm not embarrassed as it's probably silly young students doing this spamming - idiots anyway, as if we're going to give in and send them what they demand! I don't even have a webcam on my computer

Have been logging into webmail to report them as Junk/Spam and also forwarding them to report@phishing.gov.uk but they are still coming. There's not much more we can do unfortunately, apart from blocking the sent address, but if I block my own email address I won't see anything I've BCCd to myself when I've sent emails to people using it (though it's an address I don't often use).