Plusnet Alert:account Sign-In Alert is this real?

[#1]

Email received today stating; 

RE: Plusnet Alert:Account Sign-In Alert  no.07246-1870-844838

Plusnet Secure Access no.17805 <karen@[Removed].plus.com>

It suggested there was a sign in from an unrecognised device in France.

It had a link to what looks like an account login page (which I did not enter details into).

Does this seem real or a fake email?

Thanks in advance.

Moderator's note by Mike (Mav): Personal information removed from a public forum (to an area that staff can see).

[#2]

Update on this email security alert - I hovered over the link to 'review Plusnet Account' and could see the following as the link address: 

<Deleted>

This goes to a page that looks very much like the Plusnet login page!

But I assume from the link address that this is a scam.

Moderator's note:       Link deleted

[#3]

I've had loads of these over the last few days.

As you found, the link would take  you to a very "not PlusNet" location, and interestingly the origin e-mail address is usually from  another Plusnet account.

[#4]

We had the same message and it is pure spam / scam take your pick

[#5]

Yup, same here.

My identification process is simple: hit Forward, scroll down, ascertain sender.

The sender will be either an obvious scammer or a plus.com address.

In the latest case the address had sufficient detail for me to go to the business Facebook page (no website) where the spoofed sender's address was given. I emailed the spoof address and had a quick reply, person thanked me but was obviously annoyed with PN and lodged a complaint.

I was asked to do likewise but am not going to post the address here however if a staffer wishes to pm me I'll happily confirm.

[#6]

@Mardler 

but was obviously annoyed with PN and lodged a complaint.

Its almost certainly nothing to do with Plusnet

In the latest case the address had sufficient detail for me to go to the business Facebook page (no website) where the spoofed sender's address was given

That's more than likely where the scammer got the email address from!

Its rediculously easy to spoof an email address...

[#7]

This spam message is much worse than just a forged sender,
I have submitted my copy of the email source to abuse@plus.net

The originating Public IP is a Plusnet IP and at the time matched the sender's domain,
the outgoing email server was also a Plusnet outbound server from the SPF list. 

The received email Passes all of SPF / DMARC and DKIM

Was it sent from a compromised device that proceeded to SPAM via (open) relay.plus.net:25 without credentials ?

We have seen this format of SPAM so many times in the last 6+ months,
what is the email security hole that needs to be addressed ?

Is relay.plus.com still available as an Open Relay from Plusnet's internet connections ?

These spam storms maybe what keeps us on the blocked lists of Microsoft / iCloud /  Tiscali aka TalkTalk