Spam: Phishing email received from a PlusNet address

[#1]

I received an email that was supposedly from Barclays Plc with a PlustNet sender's address to an address I only gave out to a select group of companies. I've forwarded the email to abuse@plus.net but I'm curious as to how they get generated.

Misc details and message source below.

Obviously I know better than to click the links in the email.

- Chris

Subject: Barclays
Date: Mon, 31 Dec 2018 18:16:00 +0500
From: Barclays Plc <donotreply@plus.net>
To: XXXXXXX@deltav.plus.com

....

Message Source:

Return-path: <donotreply@plus.net>

Envelope-to: XXXXXXX@deltav.plus.com

Delivery-date: Mon, 31 Dec 2018 13:16:05 +0000

Received: from [212.159.9.108] (helo=avasin18.plus.net)
by inmx16.plus.net with esmtp (PlusNet MXCore v2.00)
id 1gdxQJ-00013Q-QV for XXXXXXX@deltav.plus.com; Mon, 31 Dec 2018 13:16:03 +0000

Received: from avasout03.plus.net ([212.159.9.108])
by Plusnet Cloudmark Gateway with ESMTP
id dxQHg2e5N4LifdxQJg268P; Mon, 31 Dec 2018 13:16:03 +0000

[#2]

It's very easy for the bad guys to spoof your email 'from' addresses.

I advise you to put your email address into https://haveibeenpwned.com/ to see if there's any evidence of it being leaked. If you are suspicious of this advice then do some research on this web site, you will find that it is legit. If your address appears on a malware source list then change it (or change it anyway).

Don't assume that somehow it's Plusnet's fault!.

[#3]

Hi @ChrisA, thanks for your post.

There are many ways that criminals and scammers can spoof your email addresses and so it isn't possible for us to give you the reason as to how they're generated.

I'd certainly follow @Baldrick1s advice on checking https://haveibeenpwned.com/ to see if your email has indeed been leaked.

Aside from directing you to check that site, there isn't a great deal we're able to do with regards your addresses being spoofed although we 100% understand the concern these fake emails can cause, especially with it appearing to be from a PN email address.