Spam emails from plus.com addresses

[#1]

---

@jab1 wrote:

@Batphone Are you a Plusnet account holder, or one of the 'legacy' brands? The migration is being done in stages, with the low-volume, really old legacy brands moving first.

As to the timing of this attack, yes - I suspect it is coincidental, but for obvious security reasons, I doubt much will be revealed.

---

I am a long time PlusNET customer. Not a customer of one of the historic brands such as force9. I expect that I will get notified at some point as the migration progresses.

Understood that for security reasons details of an ongoing attack will not want to be discussed.

[#2]

@Batphone 

In #44 you wrote:

“I wasn't aware of that. I have not received any notification yet. However the GreenBy website seems to confirm this with the FAQ stating that we will get notified once our account has been migrated”.

It’s been in hand for several months e.g. see Fixed: Plusnet email moving to Greenby - Plusnet Community.

One of the Greenby FAQ answers says “You’ll receive notice 60 and 30 days before the migration”. I don’t think any standard Plusnet users have received the 60 day notification yet.

Another FAQ answer says “Your Plusnet email address will remain the same and continue to function as it did before”. As the present service is virtually unusable, that is somewhat worrying!

See, for example, From address doesn't meet the authentication requi... - Plusnet Community in case you don’t know what I mean but I would have thought that all Plusnet users must be having the same miserable experience of sent emails being rejected by recipients’ providers.

And yes, I've received a few 'Boots' survey emails too.

[#3]

Thank you for explaining that so well 🙂

Spoofing can happen to anyone at any time and as you say, 

It would seem that someone has managed to obtain a list of e-mail addresses hosted by PlusNET somehow and is exploiting them to send SPAM with malicious links

As such, the way i understand it is that Plusnet can't do anything much (if anything at all) to stop this happening to us.

Ive had over 1000 since 17:00 yesterday, the last one being at 03:00 this morning - so either the spammers or in bed or may have moved on to someone else 😉

I've now had my email address blacklisted (as I discovered when trying to forward some of these to abuse@plus.net)

Ive opened a case with Plusnet and will have to go through the support process to change my email password while they remove me from the blacklist and then send me a link to restore my password.

Im not sure if that removes me from all blacklists or not - that's beyond my area of knowledge.

I also ASSUME that if the spoofs continue, I may get blacklisted again and have to repeat the process 🤷‍♂️🤷‍♂️🤷‍♂️

The emails I've had all share the following subjects or body text

Undeliverable: 9/28/2025 2:34:03 a.m. Share Your Feedback & Receive a Free Gift from Boots (@bootsUK)Your opinion matters—claim your thank-you gift!

Mail delivery failed: returning message to sender

Reason: A message that you sent to the following recipient could not be delivered due to a permanent error. ** The remote server ?? responded with: xxx@hotmail.co.uk This message was created automatically by mail delivery software on the server .

Fortunately, I have alternative email addresses I can send from.

Unfortunately, trying to filter your way through hundreds of emails on an iPhone so that you don't miss anything important is a real PITB! You can't create rules for the native email client in iOS.

I have long been planning to move all of my emails away from Plusnet, and this will accelerate the process. NOT because I blame Plusnet for any of this, but because I can then move to EE and take advantage (I have EE Mobile) of their WiFi hotspots and unlimited data 🙂

The agent I spoke to at Plusnet regarding my blacklisting suggested that Greenby, as a dedicated email provider might be able to resolve blacklisting issues over the phone, but I don't know if that is true or not (he wasn't very polite about Plusnets email service) 😉

I migrated to Plusnet when the company first started and I have to say tha

[#4]

I was trying (above)  to reply to @Batphone but keep getting a 403 forbidden error ?

I wanted to add I migrated to Plusnet when the company first started and I have to say that Ive NEVER had email problems before with them 👏

[#5]

@purkle 

You can change the password yourself - see this standard guide...

Reset email password

If you are not able to login to the email address using webmail, then it is likely that your email address has been identified as being compromised and has had its password changed. Where email address passwords have been changed to protect the integrity of the service, the Plusnet account password is left unchanged.

Which ISP are you with, Plusnet or one of the other / legacy vISPs?

Plusnet / Force9 / FreeOnline users can only change the password on the DEFAULT email address by changing the password on the user ACCOUNT through the user portal. You can change the password on a secondary mailbox using the Manage My Mail options in the user portal.

Brightview users (Madasafish / FreeNetName / GlobalNet / IC24 / ICScotland / Dialstart / Totalise) logging into webmail should use their full email address. Use the MAAF user portal to update the password on the default email address (change the account password) and use this MAAF guide to change the password on a secondary mailbox address. If you cannot recall the account password, you will need to contact support ... because the account password change process sends an email to the mailbox you cannot now access.

DO NOT USE THE SAME PASSWORD AGAIN for that would allow the continued exploitation of the account. The new password should be cryptic and not one used before.

Note that changing the account password will change the password used for logging on to the relevant user portal. If your email service is NOT a retained legacy service (one associated with a retired internet service account), then the password required by the router to connect to the internet will be changed too. If the router is a Hub Zero or a Hub One supplied by Plusnet it should update automatically. If not, you will need to log into the router, drop the connection, change the password yourself and reconnect.

On the assumption that the email address password has been compromised, I strongly recommend that wherever you have used that email address / password combination as access credentials to services such as Amazon, Netflix, eBay etc., that you also change the passwords on those service as well.

It is VERY unlikely that your email account has been compromised, so changing your password (always a good belt and braces move) is probably not going to help you.  It is possible to send an email as being from ANY email address if you know how.  SPF is a vector to inhibit such spoofing, but if one has access to a compromised Plusnet account (or several) then any email appearing to come from *.plus.com sent through Plusnet's server WILL PASS SPF.  Thus the claims made elsewhere about the effectiveness of SPF ((or not) are NOT RELEVANT in this scenario.

The two cases forwarded to me show that they were submitted from a Plusnet IP address, suggesting that numerous users are running malware - not everyone takes protection of the computing devices seriously enough ... at which point we all suffer.

Unfortunately finding Plusnet email addresses to abuse is not as difficult as one might think, there will be 1000s of them out there on the dark web as might be discovered here - Have I Been Pwned: Check if your email address has been exposed in a data breach - pop your own email address(es) therein and find out all of the third parties who are known to have leaked your email address over the years.

@James_B are you still looking for more cases of this issue - looks as though @purkle has a lot of them.

[#6]

HI @Townman 🙂

I honestly don't have any concerns about my account security, as none of these emails have come from either my webmail or Outlook client 🙂

It's a simple case of spoofing, which can probably happen to anyone, regardless of ISP or email provider 

I certainly don't blame Plusnet - they are as much victims as we are 🙂

I checked to see if I had been Pwned yesterday and all is well. 

I doubt (but hope otherwise) that Plusnet can do much about this, although I wouldn't expect them to come right out and say so 😉 

FOR NOW, the emails have stopped coming for me, but that may be because they may be emanating from a different time zone (HUGE GUESS) although they may be automated, which shouldn't be affected by that.

I plan to slowly move my email reliance from Plusnet to either Outlook or Gmail - not because of this (Ive had NO other issues with plusnet and have been with them since the start) but because of EE giving users free WiFi hotspots and unlimited data - my mobile moved from Plusnet to EE so it makes sense for me. Moving is a HUGE task for me, and Ive been avoiding it until now... gone are the days when you could migrate between Plusnet/BT/EE 😞 

[#7]

It’s a shame these messages can’t be intercepted and obliterated at Webmail level….

[#8]

Using MS Outlook and an IMAP configuration, perhaps the Outlook rules could be a possible method.

[#9]

Agreed and that would work if everyone was using one of the versions of Outlook. But, there seems to be endless amount of client software using either Imap or Pop3. It would be simpler to be able to add a rule in Webmail  with one instruction to cover all users : "This is what you need to do & this is how to do it."

[#10]

---

@Champnet wrote:

It’s a shame these messages can’t be intercepted and obliterated at Webmail level….

---

That is certainly a potential spot measure - get the AV / Anti-spam platform to treat this episode as spam.  That might have an impact on the promulgation of the payload out from Plusnet and distribution within, but it will not deal with the NDR backscatter.  Nor will it deal with the next campaign which will have an entirely different finger print.

SPF has its merits, up to a point - unfortunately it is a receiver's choice to verify it and then chose to act.  It answers the inbound question "Was that MTA permitted to send for that sender?", after it is received.  A far more useful implementation would have been a model which asks the outbound question "Am 'I' permitted to send on behalf of this sender?" before sending it.

That would have done exactly what you suggest - eliminate SPAM at source, thereby avoiding transmission entirely - no parasite pay loads on mail services and much reduced back scatter.

I did a quick Google search and found nothing hinting at this an anti-spam measure ... I wonder why no one has thought about it!

[#11]

---

@PhilipHeyes wrote:

Using MS Outlook and an IMAP configuration, perhaps the Outlook rules could be a possible method.

---

Entirely the wrong place to deal with the issue across the piece, but such could deal with an individual's blight.

What needs to happen (but it is hard) is to identify the rouge operators and close them down.

[#12]

Townman, I have given you one like for being such a grumpy old darling !

[#13]

And you Phillip, get two likes for good humour!

[#14]

---

@purkle wrote:

I was trying (above)  to reply to @Batphone but keep getting a 403 forbidden error ?

I wanted to add I migrated to Plusnet when the company first started and I have to say that Ive NEVER had email problems before with them 👏

---

I have not had any problems before with them either. Overall the service has been reliable.

[#15]

I have another "Boots Survey" email this morning, again not marked as [-SPAM-] and delivered when the sender's IP is not matching the _SPF IP lists for Plusnet emails in the format <name>@<account>.plus.com

Received: from avasout-peh-002.plus.net ([84.93.223.46])           ( IP is not on the PN  _SPF lists. )

84.93.223.46 is returned as 84.93.223.46.bizsurf.pth-ag2.dyn.plus.net
this does not have any _SPF records so is not a genuine outbound email server.

Plusnet's SMTP server avasout-peh-002.plus.net has an IP of  212.159.14.18  hence forged & not sent via relay.plus.net.

This scenario of an unexpected sender's IP is what SPF is intended to catch.