topic Re: Scam Email supposedly from PlusNet in Plusnet Feedback

Scam Email supposedly from PlusNet

merlin1 — Tue, 26 Jul 2022 13:53:43 GMT

I thought I would just warn you that if you get an email claiming to be from PlusNet and with the Subject as “Update] Your Services Agreement made clearer”

This is a scam email sent from a Hotmail address and the link in the email would take you to a server in Chile. Hardly likely that PlusNet would be using such email addresses or web servers.

DO NOT Click on the link in the email.

Re: Scam Email supposedly from PlusNet

Buggwrit — Tue, 26 Jul 2022 15:23:52 GMT

I noticed the email didn't look right and the link did not go to a Plusnet address so was going to post a query here. Thanks for confirming my suspicions. 👍

Re: Scam Email supposedly from PlusNet

deanmrd — Tue, 26 Jul 2022 21:33:10 GMT

Ok so got this mail today and it look ok until I saw the email address on the top didn't click any links just mark it as spam and reported it. when hovered over the link proceed now I could see that it was not going to Plusnet website.

Re: Scam Email supposedly from PlusNet

exsapper — Tue, 26 Jul 2022 22:36:44 GMT

Any idea of the result of clicking the link ? (Some of us are idiots!)

Re: Scam Email supposedly from PlusNet

jab1 — Wed, 27 Jul 2022 05:54:27 GMT

@deanmrd Did the 'from' address not immediately set alarm bells ringing?

Re: Scam Email supposedly from PlusNet

exsapper — Wed, 27 Jul 2022 08:37:21 GMT

Obviously not or I wouldn't be asking the question! "Plusnet [Update 5E9]" seemed a little strange but no more than that - in my naivety I probably assumed it was a new feature Plusnet had introduced. I did Google "Update5E9" to see if it had been mentioned at all and there as no result so perhaps I thought nobody had raised a query about it. What I vaguely remember happening was that after clicking the link Firefox displayed a message to the effect that the connection could not be made because a certificate was invalid or out of date or words to that effect. (At 85 my memory is not perfect!) I'd still appreciate any thoughts on whether or not clicking the link would have any ill effects.

Re: Scam Email supposedly from PlusNet

Buggwrit — Wed, 27 Jul 2022 08:39:23 GMT

"@deanmrd Did the 'from' address not immediately set alarm bells ringing?"

Yes.

Re: Scam Email supposedly from PlusNet

jab1 — Wed, 27 Jul 2022 08:42:36 GMT

@exsapper I wasn't talking about the message 'title', more the senders name/email address - Plusnet emails come from an '@Plusnet' address, not some random outlook/msn/hotmail one.

Re: Scam Email supposedly from PlusNet

exsapper — Wed, 27 Jul 2022 08:50:15 GMT

One lives and learns (And hopefully remembers!)

Re: Scam Email supposedly from PlusNet

merlin1 — Wed, 27 Jul 2022 09:07:22 GMT

The link in the scam email would take you to a subdirectory on the web server for a Chilean company called Geret which is a Telecommunications Company. Someone has managed to hack into the server and plant a nasty. Hence if you follow the link you are highly likely to catch something on your PC. the link starts with https. This means that communication to the website is supposedly secure. To ensure that the website belongs to who it says a certificate is issued by a trusted third party, for example Cloudflare. Before issuing the certificate you have to prove who you are. Certificates have to be regularlt renewed. Firefox and other browsers check that the certificate is valid and if it is not you get the warning you saw. Hence it is always good pratice to ensure you are using the latest version of the web browser, in the case of Firefox that is 103.0

Hope this answer helps

Re: Scam Email supposedly from PlusNet

Champnet — Wed, 27 Jul 2022 09:16:07 GMT

The link and the site may be secure and the owners have been verified but that's no guarantee of safe contents.

Re: Scam Email supposedly from PlusNet

exsapper — Wed, 27 Jul 2022 10:46:48 GMT

Superlatively comprehensive reply - thank you. As the Firefox message inferred that the connection could not be made does that mean I did not actually get through to the server and hence "get caught" or could I nonetheless still possibly potentially have a problem?

Re: Scam Email supposedly from PlusNet

merlin — Wed, 27 Jul 2022 11:50:51 GMT

Hi exsapper, it is very unlikely you got through to whatever nasty was lurking in the message from Hazelglidewell@hotmail.co.uk masquerading as Plusnet [Update-2D9]

If you went into the Firefox Certificate Manager and overrode the warnings maybe you would get through to

https://geret.cl/ proyecto/php_lib/ckeditor4.5.10/plugins/uploadcare/icons/

above is the actual hyperlink (with some added spaces) which is hiding behind the 'Proceed now' text

it is possible you would catch something. Maybe if you set up a virtual windows machine you could actually try it.

BTW similar safeguards exist in Google Chrome and MS Edge browsers.

Re: Scam Email supposedly from PlusNet

Gandalf — Thu, 28 Jul 2022 10:15:42 GMT

Thanks for the heads up.

If anyone still has the email, please forward it to abuse@plus.net then delete it straight away.

We go into more detail here https://www.plus.net/help/legal/service-abuse/