Spam emails being sent/received

[#1]

---

@purkle wrote:

Plusnet now thinks that it's THEM that have blacklisted me! Apparently, 285,000 YES two hundred and eighty five thousand emails were sent from my account on Sat/Sun 27th 28th September!!!!

This case remains open

---

@purkle That doesen't take a genius to suspect a spambot - somewhere.

[#2]

---

@PhilipHeyes wrote:

Are we to read that as 285K messages were sent via the Plusnet SMTP servers using your email credentials ?

Perhaps there is some other explanation.

---

YES! I was gobsmacked! I asked him to confirm and YES! 285K!!!! 🤷‍♂️😲

[#3]

I would have focused on was this sent using my email username + password ?

Or from my internet connection using relay.plus.net port 25 without credentials i.e as an open relay as it used to be ?

[#4]

---

@PhilipHeyes wrote:

I would have focused on was this sent using my email username + password ?

Or from my internet connection using relay.plus.net port 25 without credentials i.e as an open relay as it used to be ?

---

Ive confirmed to them that at no time has anything been sent from my webmail or client, as nothing is seen in the sent items. Perhaps they MIGHT check what you suggest 🤷‍♂️

[#5]

I still can’t send any emails. I receive emails okay. My PN support person messages me every working day with the same message “I’ve chased again but still no response”
I was told previously PN have blacklisted my email address and I’m waiting for them to take me off the blacklist in the hope the spoofing problem will have stopped and I can start sending emails again.
I’ve had to open a gmail account in the meantime.

[#6]

Plusnet have removed me from their blackist so it WAS their system that implemented it and they CAN resolve it.
I hope you get this sorted soon!
The team gave me their number.
0800 587 2677
My agent was ( I wouldnt normally give names) Dan Wilcox 🙏

[#7]

There are some dangerous assumptions being made here, which are not entirely helpful.  It is not clear to me what is being blacklisted / blocked (I have sought clarification) and without that clarification there is a marked risk of false assertions being made.  The act of sending emails has four key characteristics...

• The submitting device's IP address (the source)
• The indicated from (sending) address
• The submission SMTP service
• The authentication credentials associated with the SMTP service

If you know what you are doing, you can send from any email address, using any device, using any valid authentication credentials.  They DO NOT need to be aligned.  SMTP servers do not correlate sending address with the sending credentials.

Add to that, the fact that the action of sending does not place an outbound email item into the sent folder - that is (if at all) done by the IMAP side of the email client, after successful submission to the outbound server.  Consequently the observation that there are no messages in the sent items folder (the one that you can see...) is no assurance that someone somewhere has not sent out items using your email address as the sender.

There is the very possibility that some bit of dirty software is sat on your machine, sending emails as though from you leaving no evidence of its activities.

In some ways I think a lot has been lost with the dumbing down of fire wall tools which have removed the necessity for proactive decision making on what does and does not connect to the internet out of the explicit control of the user.  I was recently remined of ZoneAlarm, my then go to firewall tool - every outbound application had to be explicitly approved - might be seen as a pain by many, but such inhibited the freedom of rouge software to quietly use your machine / internet connection for nefarious purposes.

@purkle what anti virus and firewall tools do (did) you use?

[#8]

Thanks @purkle
My agent is also Dan Wilcox (so hopefully a real person!). I receive but still can’t send email and have asked them to explain why again today.
I used my partners laptop (I only use an iPhone) to get onto PN webmail and it lets me create and email and shows as sent, but it’s not delivered to the recipient and I don’t receive an failed message notification.
Hopefully mine will be sorted soon!

[#9]

4 minutes ago

---

@Townman wrote:

There are some dangerous assumptions being made here, which are not entirely helpful. 

@purkle what anti virus and firewall tools do (did) you use?

---

I say what I see, and I quote in good faith what Plusnet and Spamhaus have quoted to me. If either of them is wrong, then I have no control over that.

I use Malwarebytes Standard, paid for and Windows Defender. I used to use Zone Alarm.

Plusenet said that THEY had removed me from their blacklist system, perhaps anyone in contact with them at a higher level could get their take on this - it would perhaps remove some of the doubts.

My Plusnet email will soon be closed as I move to Outloook.com 

If the spoofing HAS resulted from dirty software on my machine, then I find it strange that only Plusnet emails have been harvested - which rightly or wrongly takes me back to the belief that a mass list of Plusnet emails has been obtained rather than them being taken from our own PC's 🤷‍♂️

[#10]

---

@Townman wrote:

There are some dangerous assumptions being made here, which are not entirely helpful. 

@purkle what anti virus and firewall tools do (did) you use?

---

I say what I see, and I quote in good faith what Plusnet and Spamhaus have quoted to me. If either of them is wrong, then I have no control over that.

I use Malwarebytes Standard, paid for and Windows Defender. I used to use Zone Alarm.

Plusenet said that THEY had removed me from their blacklist system, perhaps anyone in contact with them at a higher level could get their take on this - it would perhaps remove some of the doubts.

My Plusnet email will soon be closed as I move to Outloook.com 

If the spoofing HAS resulted from dirty software on my machine, then I find it strange that only Plusnet emails have been harvested - which rightly or wrongly takes me back to the belief that a mass list of Plusnet emails has been obtained rather than them being taken from our own PC's 🤷‍♂️

[#11]

@Townman
I only use an iPhone so antivirus and firewall are whatever comes as standard with it.
Does that make a difference?

[#12]

GOOD POINT @visionfields 👏

[#13]

> My agent is also Dan Wilcox (so hopefully a real person!). I receive but still can’t send email and have asked them to explain why again today.

He is infeed real, and he's chasing these issues hourly for you (well, at least daily). 

[#14]

And as if by magic…… I’m pleased to report I am now able to send receive emails again!

So whatever it was it must be fixed I guess.

Thanks to all those who must have been hard at work behind the scenes!

[#15]

THAT'S WONDERFUL NEWS! 😀

[#16]

We have another Boots Survey email sent as or from:  <name>@<account>.plus.com

Received: from avasout-peh-001.plus.net