Please Help me stop unwanted emails

[#1]

Foe weeks I have been getting 20-24 emails a day purporting to be sent by my own Plusnet email address.
If I can give you the gist of how they start -
the heading is YOU PERVERT, I RECORDED YOU!

- Hello! Unfortunately, there is some bad news for you.

Some time ago, your device was infected with my private Trojan, R.A.T (Remote Administration Tool).

If you want to find out more about it, simply use Google.

My Trojan allowed me to access your files, accounts, and your camera.

There is more but as an elderly lady I am embarrassed enough without repeating it here.
I have read that I can be scammed by someone using my own email address and have changed my password and reported it as phishing but they still arrive hour after hour.
Please advise me on what to do.  Katie

[#2]

@Katie222 Sadly, this kind of thing happens from time to time. They may appear to come from your own address, but if you check the name in the angled brackets '<someone@somewhere.com>, they are sent using your name, but not actually from your email.

Sorry you have been plagued for so long, but they will stop eventually.

All you can realistically do is delete them unread.

[#3]

Katie222

Don't worry!

Could they have infiltrated your computer or email account? Possibly. But it is at least (if not more) likely it is just a bluff. They do obviously know your Plusnet email address, which they are spoofing (this is not difficult to do) when emailing you. They are trying a typical email blackmailing scam on you (and probably many others).

https://www.ncsc.gov.uk/files/sextortion-scams-infographic.pdf

As a first step, and precaution, it would be best to try and change your account passwords. Advice can be found in the above link.

Strong passwords are LONG. One known way of generating easy to remember ones is to use three random words. e.g. SugarRatClock, a number at the end could indicate the year first used: SugarRatClock26.

Never be tempted to make ANY response of any kind to the sender - not even to any 'Click here if you do not want to receive any further emails' - unless it is not Spam but advertising etc. from a genuine supplier you have a relationship with.

There are more sophisticated (but technical) ways of tackling the issue if it persists

[#4]

@Katie222  I've been getting the same email regularly over the past few weeks, they are an embarrassing nuisance. I don't use a Plusnet email address so they are not coming through the Plusnet system. They are originating from someone using a Russian service. I suspect our email address' have been harvested from an online business using a not-so secure security system. Nothing to worry about and they will eventually stop but if it makes you feel better change your password.........

[#5]

Thanks John, it helps to know that they will stop eventually.
I do delete them as I hate to just look at them.

Regards, Katie

[#6]

Thank you for your comments and advice.
I do have security on my system and did change my passwords and I'm sure that I have not been infiltrated.
I never reply to emails or click on anything but this one has got me beat.
I just hope that they get fed up and go away.

Regards, Katie

[#7]

 Thank you for your reply and sorry that you are also getting these offensive mails.

I did change my email but they lost carry on. I hope they stop soon for us both.

Regards, Katie

[#8]

I also have been plaqued for weeks with exactly the same email.

I am with Greenby since Dec25 when first started have put all the senders into Block/Blacklist 

have complained to Greenby have upped scam filter to no2 NO USE

Today i have received 4 emails all showing to have come from my own full email address

Greenby just says i have been spoofed and not to worry

I changed my password a while back when getting about 10 per day

Can only hope they dissapear soon

KenM 

[#9]

I'm getting these too - maybe three or four a day. They seem to arrive in batches. I honestly wish I had the stamina that this scammer is implying

Here is the full header from one of them. The sending IP address seems to change every time.

Return-path: <my plusnet email>
Envelope-to: my plusnet email
Delivery-date: Mon, 06 Apr 2026 14:43:24 +0100
Received: from [84.93.230.243] (helo=avasin-ptp-007.plus.net)
by inmx-peh-007.plus.net with esmtp (PlusNet MXCore v2.00) id 1w9kEe-000BI3-Rv
for my plusnet email; Mon, 06 Apr 2026 14:43:24 +0100
Received: from mail.enmail.co ([91.204.208.8])
by Plusnet Cloudmark Gateway with ESMTP
id 9kEWwW4t9l3NF9kEWwe3jG; Mon, 06 Apr 2026 14:43:16 +0100
X-CM-Score: 100.00
X-CNFS-Analysis: v=2.4 cv=O4iavw9W c=1 sm=1 tr=0 ts=69d3b874
p=xuSakxmQ/AEa0MmB+nwSGURWKu8=:19 p=NX+gl+Xpg2tz9MSno0cNtH3+2FI=:19
p=bU8HyK+u2KSFcGbJwLAM7afV7Pw=:19 p=gve5RamNw6ExUc_rcJwu:22
a=/50HAxhVri9f9h8qkinWjQ==:117 a=DcbIDYK6h3DEYZsrSIB62w==:17
a=A5OVakUREuEA:10 a=tQgp67HcAAAA:8 a=lxoXj2O9AAAA:8 a=5TAOmqheAAAA:8
a=es68Ls6DAAAA:8 a=n_qX3DqFkvG4QMFIzRAA:9 a=7zbRnxVGAaKOODsWIkmG:22
Received: from [192.223.121.215] (unknown [192.223.121.215])
by mail.enmail.co (Postfix) with ESMTP id 4CA4AC030D
for <my plusnet email>; Mon, 6 Apr 2026 13:43:14 +0000 (UTC)
Authentication-Results: mail.enmail.co;
dkim=none;
spf=softfail (mail.enmail.co: 192.223.121.215 is neither permitted nor denied by domain of my plusnet email) smtp.mailfrom=my plusnet email;
dmarc=fail reason="No valid SPF, No valid DKIM" header.from=plus.com (policy=none)
Received: from agcafwa ([193.29.43.234]) by 15025.com with MailEnable ESMTP; Mon, 6 Apr 2026 09:43:18 -0400
Received: (qmail 18754 invoked by uid 187); 6 Apr 2026 09:43:16 -0400
From: my plusnet email
To: my plusnet email
Date: Mon, 6 Apr 2026 09:43:18 -0400
Message-ID: <187540.187540@15025.com>
Mime-Version: 1.0
Content-type: text/plain;
X-Spamd-Result: default: False [9.94 / 4.00];
VIOLATED_DIRECT_SPF(3.50)[];
BAYES_SPAM(2.24)[90.20%];
SUBJ_ALL_CAPS(2.10)[28];
CT_EXTRA_SEMI(1.00)[];
R_MISSING_CHARSET(0.50)[];
MV_CASE(0.50)[];
MIME_GOOD(-0.10)[text/plain];
DMARC_POLICY_SOFTFAIL(0.10)[plus.com : No valid SPF, No valid DKIM,none];
RCVD_NO_TLS_LAST(0.10)[];
ASN(0.00)[asn:26210, ipnet:192.223.121.0/24, country:BO];
FROM_NO_DN(0.00)[];
RCVD_COUNT_ONE(0.00)[1];
MIME_TRACE(0.00)[0:+];
TO_EQ_FROM(0.00)[];
RCPT_COUNT_ONE(0.00)[1];
R_DKIM_NA(0.00)[];
MISSING_XM_UA(0.00)[];
NEURAL_SPAM(0.00)[1.000];
FROM_EQ_ENVFROM(0.00)[];
FUZZY_RATELIMITED(0.00)[rspamd.com];
R_SPF_SOFTFAIL(0.00)[~all];
TO_MATCH_ENVRCPT_ALL(0.00)[];
TO_DN_NONE(0.00)[];
BITCOIN_ADDR(0.00)[17EZaSdSndsyuQC8xJxarrFse19QiDdFQJ];
ARC_NA(0.00)[]
X-Spam: Yes
X-CMAE-Envelope: MS4xfHX07u45pxJqgsRF89PueXNfMy7vtEDn0P8+Mx3PgzsmQIUJojRbxOBJv4Q0WRQWwTO3Y4GCp3Nr8ZfCXTstJss5hvZdOsLfel9lp+y/U12jvMG+RU0K
5jgexqFPjzZ+uHRMWgjF3hPVqVbxeuQ3Twq1XTxm7wWBrmHPiax90LpHsbIbD43IKesLuD83/O6taCZttJ8yWQRQqCOnghvT4exBlh9FD4UKxqXFQow4EnPp
X-pn-pstn-db:" Spam 99
X-PN-Virus-Filtered: by PlusNet MXCore (v5.00)
X-PN-Spam-Filtered: by PlusNet MXCore (v5.00)
Subject: YOU PERVERT, I RECORDED YOU!

[#10]

"Received: from agcafwa ([193.29.43.234]) by 15025.com with MailEnable ESMTP; Mon, 6 Apr 2026 09:43:18 -0400"

Is the above the IP address that keeps changing? The given one is listed as for domain vector.com registered in Stuttgart.

inetnum: 193.29.43.0 - 193.29.43.255
netname: DE-VECTOR-193-29-43_24
descr: Vector Informatik GmbH 2. PI (ehm. TESIS GmbH)
country: DE

% Abuse contact for '193.29.43.0 - 193.29.43.255' is 'VI_Domainadm@vector.com'

[#11]

I've had 3 this morning :

77.183.185.139 Germany
5.251.37.154 Kazakhstan
5.251.37.154 Kazakhstan

[#12]

Spoofing is a fact of life these days unfortunately 🙁. I don't use PN email, but have tried everything to prevent my domain being used. Sometimes I get 30 or 40 at a time. My worst was 200 in a day, all using my email as a reply to, none sent through the email server. Luckily, Mailwasher stopped me having to download them all. I thought there was a way for the email records to be changed so that an email can't be sent with a false domain, but it seems not.

The list you are on will be exhausted soon and it should settle down. Hopefully it doesn't happen too often.

[#13]

It's been a long time since I had any of these 'I know what you've been doing'-type emails.

The laughable thing was wanting money or they would email webcam footage to family and friends. At the time I didn't even have a webcam.

As others have said, ignore and delete them. They prey on the vulnerable and hope that out of the thousands they send a few will comply.

[#14]

Statistically 0.07% of recipients will respond positively.

[#15]

I've got four more this morning. Which line in the header would be most relevant for the IP of the server it was actually sent from?

P.S. I'm not worried about this in the slightest, it's not exactly the first time it's happened. But the frequency of these mails is a trifle annoying, especially as I get them on my mobile. 

What is more annoying is that they are so obviously spam, I would have expected them to be filtered at the PlusNet end...