cancel
Showing results for 
Search instead for 
Did you mean: 

Spam to plusnet-specific Email address.

Community Veteran
Posts: 5,569
Thanks: 349
Fixes: 5
Registered: ‎11-08-2007

Re: Spam to plusnet-specific Email address.

Quote from: Bob
Quote from: aich
However one sent on 17/07/14 about changes to phone packages comes from "mx1.bt-plusnet.trclient.com"

I am interested to know if everyone affected received this email though and if they did, on what date? The emails should also have a reference number on them somewhere.

I've not received the message on or around the 17/07/14,  however I have received the following three messages from "trclient.com" to my private Plusnet billing email address.
Return-Path: <bounced@bt-plusnet.trclient.com>
Delivery-Date: Thu, 28 Feb 2013 19:24:25 +0100
Received: from mx1.bt-plusnet.trclient.com (mx1.bt-plusnet.trclient.com [202.43.5.89])
From: =?utf-8?B?UGx1c25ldA==?= <plusnet@comm.plus.net>
Reply-to: autoemail@plus.net
Date: Fri, 1 Mar 2013 05:23:44 +1100
Message-Id: <979660682.2082457313@bt-plusnet.trclient.com>
Subject: Is it time to start saving on your phone bill?

Return-Path: <bounced@bt-plusnet.trclient.com>
Delivery-Date: Thu, 01 Aug 2013 18:46:18 +0200
Received: from mx1.bt-plusnet.trclient.com (mx1.bt-plusnet.trclient.com [202.43.5.89])
From: =?utf-8?B?UGx1c25ldA==?= <plusnet@comm.plus.net>
Reply-to: autoemail@plus.net
Date: Fri, 2 Aug 2013 02:46:08 +1000
Message-Id: <1110814163.-882733546@bt-plusnet.trclient.com>
Subject: Important information about your Plusnet service.

Return-Path: <my-private-mailbox@my-private-domain.uk>
Received: from mx1.bt-plusnet.trclient.com ([202.43.5.89]) by
From: "Plusnet" <Plusnet@comm.plus.net>
Reply-to: autoemail@plus.net
Date: Fri, 23 May 2014 02:25:35 +1000
Message-Id: <1489839548.520932567@bt-plusnet.trclient.com>
Subject: Go on, make things easier for yourself and take our calls

Sad
Plusnet FTTC 80/20 IPv4/30, Hurricane Electric 6in4 IPv6/48, Pulse8 landline & calls, SamKnows 600N
Vigor 130 modem, pfSense 2.4.4-p3 router, 5 WAPs, Devolo dLAN 500, Gigaset N300A-IP VoIP DECT
LordFox
Grafter
Posts: 211
Thanks: 6
Registered: ‎10-03-2008

Re: Spam to plusnet-specific Email address.

I can't say if I received the "trclient.com" emails as I am in the habit of just deleting spam, although I'm now keeping the relevant emails.
Anit-spam services have been mentioned as a possible source. On my Clara account, there is no anti-spam filtering or anything like that. I don't use any other service for this. I just delete it myself. So, no one else is seeing my PN emails. Only Clara, PN, and me.
If it was just me getting this spam, I would say there could be other options than it being obtained somehow from PN's database. Sniffing traffic at Clara, for instance. Far-fetched, but easy enough to do. That's not the case.
Whatever variables are in play here, the one truly common factor is that many people with PN-specific addresses are receiving this specific spam. I know for a fact that I have never used my Clara PN address for anything, ever, except to register it for my PN account and this forum. I guess others here can say the same.
That points to it having come, in some way however convoluted, from PN. Unless GCHQ or NSA have entered the spam business (wouldn't put anything past government).
Community Veteran
Posts: 3,425
Thanks: 19
Registered: ‎18-01-2013

Re: Spam to plusnet-specific Email address.

Literally just received this retention email from PN - noticed the trclient bit .....
Authentication-Results: hotmail.com; spf=pass (sender IP is 202.43.5.89) smtp.mailfrom=bounced@bt-plusnet.trclient.com; dkim=pass header.d=comm.plus.net; x-hmca=pass header.id=Plusnet@comm.plus.net X-SID-PRA: Plusnet@comm.plus.net 
Community Veteran
Posts: 5,569
Thanks: 349
Fixes: 5
Registered: ‎11-08-2007

Re: Spam to plusnet-specific Email address.

Quote from: LordFox
I can't say if I received the "trclient.com" emails as I am in the habit of just deleting spam, although I'm now keeping the relevant emails.

The "trclient.com" emails are NOT the SPAM ones, they were genuine marketing messages originating from Plusnet, but those emails were sent on behalf of Plusnet using a third party email distribution service "trclient.com".
The question is whether or not "trclient.com" have sold or leaked our Plusnet private billing account email addresses to spammers ?.
Has Bob asked "trclient.com" whether they have used our email addresses for any other purpose ?
Plusnet FTTC 80/20 IPv4/30, Hurricane Electric 6in4 IPv6/48, Pulse8 landline & calls, SamKnows 600N
Vigor 130 modem, pfSense 2.4.4-p3 router, 5 WAPs, Devolo dLAN 500, Gigaset N300A-IP VoIP DECT
KevinG
Rising Star
Posts: 990
Thanks: 10
Fixes: 1
Registered: ‎05-11-2008

Re: Spam to plusnet-specific Email address.

Why are people bothered about the trclient.com thing? Plusnet use it to send marketing e-mails, what's the connection?
Edit: just seen previous post. Fair comment.
Community Veteran
Posts: 19,107
Thanks: 450
Fixes: 21
Registered: ‎31-08-2007

Re: Spam to plusnet-specific Email address.

Kevin, you aren't even considering the possibility of 3rd party services getting hacked - who knows?
LordFox
Grafter
Posts: 211
Thanks: 6
Registered: ‎10-03-2008

Re: Spam to plusnet-specific Email address.

Just got one from a new source...
news@rockmsockmnews.com
Same physical address and message format as the others, now on the PPI track Angry

Return-path: <news@rockmsockmnews.com>
Envelope-to: (REDACTED)
Delivery-date: Tue, 25 Nov 2014 21:17:17 +0000
Received: from rockmsockmnews.com ([23.229.2.14]:36688)
by mx16.mail.eu.clara.net (mx-vh.clara.net [81.171.239.26]:1025)
with esmtp id 1XtNU4-0002ab-MI  for (REDACTED)
(return-path <news@rockmsockmnews.com>); Tue, 25 Nov 2014 21:17:17 +0000
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; s=default; d=rockmsockmnews.com;
h=From:To:Subject:Reply-to:Message-ID:MIME-Version:Content-Transfer-Encoding:Content-Type:Date; i=news@rockmsockmnews.com;
bh=0TlRRZ9jQYaQ50XObzohH/wqgKbq8ataLqgzRds4FZk=;
b=DaGbTwqM17RrDIqa84cYixLH8QKpRqAVgq5epwWO8XjU558g++yagvkgYuHI19CaOioysHgO0uxV
  essXOprChYTdpckrEp5kfkWfwW2LkWRbFcRGnXO/2BMw8P8rUBlzIqOnY+IyNSNRGYIaERJTP8xR
  RrXFGkNh59tbORfzx6g=
Received: by rockmsockmnews.com id hek00c0001gm for <(REDACTED)>; Tue, 25 Nov 2014 14:43:42 -0500 (envelope-from <news@rockmsockmnews.com>)
Received: from rockmsockmnews.com (rockmsockmnews.com. [23.229.2.14]) by rockmsockmnews.com with SMTP id 76be87b48e429f61c14867de1bc24e59.1416940998; Tue, 25 Nov 2014 13:43:18 -0500
From: "The Claims Guys" <news@rockmsockmnews.com>
To: (REDACTED)
Subject: ((REDACTED)) 30 second application to reclaim your mis-sold PPI - News
Reply-to: news@rockmsockmnews.com
Message-ID: <76be87b48e429f61c14867de1bc24e59@rockmsockmnews.com>
MIME-Version: 1.0
Content-Transfer-Encoding: quoted-printable
Content-Type: text/html; charset="UTF-8"
Date: Tue, 25 Nov 2014 14:43:42 -0500
X-Sender-Verification-Failed: Sender verify failed
X-Original-Recipient: (REDACTED)
X-Original-Sender: news@rockmsockmnews.com
sandjwa1
Dabbler
Posts: 15
Registered: ‎26-11-2014

Re: Spam to plusnet-specific Email address.

Quote from: alanonplusnet
I've started receiving Spam Emails sent to an Email address that I've only given to Plusnet.  Anyone else seen this, or just me?

Not just you.  I have an email address that I have never used to send email that I use to receive PlusNet emails.  It is in the format of <validword+somecharacters@my-own-domain.co.uk>
I gave PlusNet this email address about 3 to 5 years ago; it did not exist in 2007.
I noticed these spam coming in to that address from 13th November.  The same messages as you are all reporting.  Angry
I own at least 10 domains for which I receive all email sent to them and I get plenty of spam; I am only getting these messages to the email address I gave PlusNet.
This email address has never received any other spam.  I know that as I have kept every spam message I have received since April 2012.
PlusNet, have you informed the Information Commissioner's Office  yet?  You held a personal email address of mine that nobody else had and now they have.  There has been a personal data breach.
Quote
Telecoms or internet service provider?
Organisations who provide a service allowing members of the public to send electronic messages (eg telecoms providers or internet service providers) are required to notify us if a personal data breach occurs within 24 hours of becoming aware of the essential facts of the breach.

The only two other messages to that email address (beside those from support@plus.net  and  plusnet@comm.plus.net ) are attached.  They came from BT / trclient.com
bletchingley
Newbie
Posts: 3
Registered: ‎21-08-2010

Re: Spam to plusnet-specific Email address.

Mails have just started again....
arrived 22:40
Black Diamond Visa Card (news@liveuknews.co.uk)
Community Veteran
Posts: 5,569
Thanks: 349
Fixes: 5
Registered: ‎11-08-2007

Re: Spam to plusnet-specific Email address.

Here is the webpage to "Report a concern" to the "Information Commissioner's Office".
[quote=http://ico.org.uk/concerns/handling]How your information is being handled
If you have a problem about the way an organisation has handled your personal information – perhaps they hold information about you that’s wrong, they have lost it or disclosed to somebody else  – let us know the details.
Plusnet FTTC 80/20 IPv4/30, Hurricane Electric 6in4 IPv6/48, Pulse8 landline & calls, SamKnows 600N
Vigor 130 modem, pfSense 2.4.4-p3 router, 5 WAPs, Devolo dLAN 500, Gigaset N300A-IP VoIP DECT
Community Gaffer
Community Gaffer
Posts: 14,081
Thanks: 1,655
Fixes: 127
Registered: ‎04-04-2007

Re: Spam to plusnet-specific Email address.

Quote from: LordFox
That points to it having come, in some way however convoluted, from PN.

I haven't said anything to the contrary. Imagine a theoretical case though, of an employee's machine used to handle mailshot data (not necessarily a Plusnet employee). It's not outside of the realms of possibility for this machine to contract a malware/virus that could lead to something like this. Sadly, in this scenario, the source is likely to prove very difficult, if not impossible, to isolate Sad
What I can say for certain though, is that we have found no evidence of any wrongdoing across the core systems where your billing information is stored.
Quote from: purleigh
The question is whether or not "trclient.com" have sold or leaked our Plusnet private billing account email addresses to spammers ?.

I very much doubt this.
Quote from: purleigh
Has Bob asked "trclient.com" whether they have used our email addresses for any other purpose ?

Not personally, but any company we enlist the services of must keep any shared information secure in accordance with our instructions, and must comply with the Data Protection Act.
Quote from: LordFox
Just got one from a new source...
news@rockmsockmnews.com

I'll let you know if the situation changes, however I doubt there's much merit in us collecting any further examples. The brutal reality is that it's likely to continue and it's futile attempting to identify the origin. The spammers are registering domains, configuring them with SPF records, reverse DNS etc. and then using that to improve the apparent legitimacy of the messages sent from the machines they're using to spam. After a while, they'll rinse, wash and repeat with a new domain/IP address.
Quote from: purleigh
Here is the webpage to "Report a concern" to the "Information Commissioner's Office".

This is something that's sat with our regulatory department. As mentioned, I've been out for he country this last week so give me some time to catch up with them.

Bob Pullen
Plusnet Product Team
If I've been helpful then please give thanks ⤵

Community Veteran
Posts: 1,136
Thanks: 2
Registered: ‎30-07-2007

Re: Spam to plusnet-specific Email address.

Quote from: Bob
[..] The brutal reality is that it's likely to continue and it's futile attempting to identify the origin.[...]

Called it!
Quote from: avatastic
Nope, they've pushed it under the rug and aren't doing a damn thing about it.
F9 member since 4 Sep 1999
F9 ADSL customer since 27 Aug 2004
DLM manages your line the same way DRM manages your rights.
Look at all the pretty graphs! (now with uptime logging!)
RobPN
Aspiring Hero
Posts: 2,871
Thanks: 1,118
Fixes: 5
Registered: ‎17-05-2013

Re: Spam to plusnet-specific Email address.

Having said earlier in the thread that I wasn't receiving this SPAM, I followed someones suggestion of turning off the PN SPAM filter on my main account.  Within a few hours of doing so I started receiving 2 copies each of several SPAM emails as described by others in the thread, 1 copy of each to each of 2 unique addresses which are based on my main account name.  One of those addresses is my PN billing address, the other is a 'contact' address I created when I registered a PAYG account several years ago.
I have several other PN accounts but I've not checked anything other than my main account yet.  Having said that I've just made time to login to a couple more accounts and turn off the SPAM filtering - will wait and see what happens to them.
Alan92957
Newbie
Posts: 2
Registered: ‎26-11-2014

Plusnet passing on details or hacked

I have a specific email address I only use with Plusnet that only they have access to.
I have recently been receiving unsolicited mail to this email address from:
news@onepoundnews.co.uk
news@liveuknews.co.uk
news@bigtimenewstime.com
Does anyone else receive emails from these addresses?
I have asked Plusnet if they pass on my details but they haven't given me a straight reply.
Alan
Community Veteran
Posts: 1,136
Thanks: 2
Registered: ‎30-07-2007

Re: Plusnet passing on details or hacked

[redacted content from merged thread]
F9 member since 4 Sep 1999
F9 ADSL customer since 27 Aug 2004
DLM manages your line the same way DRM manages your rights.
Look at all the pretty graphs! (now with uptime logging!)