Phishing email from 'Plusnet Support'

[#1]

Who do I forward this to these days please?

Obviously wrong in so many ways but Plusnet need to be made aware

Plusnet Support <ocglolwvwd@cira.ca>

[Online Support Announcement] - Action required - Review this email

Unusual Login Attempt.

Dear xxxxx@xxxxx.plus.com,

Security notification.

Date	IP Address	IP Address 2	Browser
8/8/2018 4:32:51 p.m.	81.83.255.11	81.83.255.12	Mozzila Firefox

8/8/2018 4:32:51 p.m. IP address of your previous login differs from current IP address.

Previously you logged in from United States.

Now you`re trying to logon from 81.83.255.122, (Antwerpen , Belgium).

If previous login was yours, then ignore this message.
If it was not, then it means that someone tries to access your account.

Please (here was the link to click on, now removed) in order to avoid account suspension.

Thanks,

Plusnet

[#2]

Stupidly just got caught with this.  Interesting to see what happens next!

[#3]

Have you changed your log-in password since? Otherwise they can get get into your account and steal personal details.

[#4]

Yes Mad_Moggies, have changed password.  Seemed favourite thing to do.  Thanks for the notice though.

[#5]

I just got same email saying exactly the same thing.

I always look at address that sent it to me. I would never use a link in an email. Even if the email looks real I would open a browsers and goto the website directly.


Thanks

DeanO

[#6]

Me too but I can't see anywhere to send it to report it, even in webmail. I'm sure I used to be able to do that in the dim distant past (hardly any spam etc on my Plusnet addresses as usually caught by their spam filters).

Sending address was wrong, IP addresses were wrong, countries were wrong and link (copied to clipboard) was wrong. also it was addressed to one of my email addresses and not to me personally which all genuine Plusnet emails are.

[#7 · Accepted solution]

If you want to report the phishing attempt to Plusnet you can forward it as an attachment to abuse (at) plus.net. You'll have to convert that text into a proper email address. However it's possible the report will bounce.

You could report it as spam by logging into webmail, highlight the message in the Inbox list, then click the "Mark as spam" button which is immediately to the right of the red "Delete" icon.

[#8]

Thanks for the 'abuse' address (the ones I had were well out of date). However, even trying to forward the email as an attachment meant it was rejected by the servers and just stayed in my outbox.

How I missed the spam marker in webmail is a mystery! I knew it should be there but just didn't see it!

Anyway, I'm emailing them with the link to my message here so they can have a look at the offending phishing link and will send the full headers in that email.

[#9]

It's noted elsewhere that the abuse address now rejects messages because the mailbox is full (with the volume of reports).

There is a similar topic on the Everything else board, and also in General chat.

[#10]

In my case the pop-up (in Mail on my Mac) said it couldn't be delivered because spam/phishing content may have been detected (or words to that effect). The other email, where I put a link to this discussion and full headers, went through fine.

[#11]

Unusual Login Attempt.

  This email is from 'aueh@cira.ca' which is a little different to the sender to Mad_Moggies although Mad_Moggies and I seem to have used the same IP addresses from the same locations!

Dear yyyy@zzzzzz.plus.com,

Security notification.

Date IP Address IP Address 2 Browser 8/8/2018 5:18:33 p.m. 81.83.255.11 81.83.255.12 Mozzila Firefox

8/8/2018 5:18:33 p.m. IP address of your previous login differs from current IP address.

Previously you logged in from United States.

Now you`re trying to logon from 81.83.255.122, (Antwerpen , Belgium).

If previous login was yours, then ignore this message.
If it was not, then it means that someone tries to access your account.

Please confirm your identity in order to avoid account suspension.

Thanks,

Plusnet

Moderator's note by Mike (Mav): Link made unclickable.

[#12]

help! 

I have clicked this link and supplied my details and now I cant work out how to change my password

Thanks 

[#13]

I received the same email yesterday!

[#14]

Hmm maybe it is best a mod can remove the link from the original post just in case someone does click on it, but make sure PlusNet is aware.

Probably not much PlusNet can do really, I tested it and put some rubbish details in and got redirected to the help pages. If I could be bothered and wanted to be a bit naughty I would write a script I suppose to flood their database with rubbish.

But yes, anyone who has used that link had better change their password. I suppose the best policy is to never click on links which direct you to a site asking for personal details.

The only time I click on links on e-mails is when I have to confirm who I am.

Thanks for letting us know.

EDIT: Just seen another thread on a similar subject - again thanks as it is important PlusNet know they are currently being targeted as it may have repercussions on them and the users obviously.

[#15]

Alex, I've now removed the link from my original post but I see at least one other person has it in theirs.

Yes, it's better never to click on links in emails to log-in pages but to go to saved bookmarks.