Spam

[#1]

@spraxyt - I would still have thought the routing would give an indication of origin, though?  I bow to your greater knowledge, though, because I've only ever had two quarantine messages in my time here, and accepted them both without checking.

[#2]

The alerts don't actually have any routing information, just From, Subject, To, Date and Message-Id headers. The content of the To and Message-Id lines is coded. I'm sure the quarantined message would have routing information but I'm not curious enough to unquarantine and check that.

I;m not going to post an example, don't want to give the spammers ideas. 

[#3]

I didn't get ANY emails today and was quite excited at first as thought "wow, it's all stopped".

Come this afternoon and into the evening, still nothing, no spam or any other emails.

Come this evening and I was a little concerned as to what is going on as still nothing.

I have received an email from the support team that says the following...

------------------------------------------------------------------------------------

Dear ****,

Thanks for getting in touch,

The issue appears to be that your email address has been compromised and someone is sending mass emails out via your address.

I've therefore disabled your email to refuse access to all, and you'll now need to change your email password and run a full virus scan on your device.

After this has been done, please let us know and we'll enable your email account again. 

Please do not hesitate to get back in touch online at http://contactus.plus.net or by phone on 0800 028 0282 if we can be of further assistance.

Kind regards,

*i've removed the support guys name*

Email access switched off

-----------------------------------------------------------------------------------------------------------------------------------

Now I changed my password in the midst of me being email bombed by all these return delivery failures and it was still happening... My Laptop is Ubuntu and now has an AV suite installed (though nothing found).. Admittedly I do also use Win 10 on a PC but that has be virus checked also.

Obviously support can see at a server level if my account was blasting out thousands of emails, though that said, someone doesn't need access to ones account to achieve this, all one has to do is to make it look like it was sent from another address and they will bounce back to that.

I have turned the "receive emails" feature back on without making any changes and if I still get these coming in.

I could be wrong but I am not sure if my account was doing this and would like to see a screen grab of a section of the emails gone out via my address.

Will update tomorrow to notify if any are getting through..

Moderator's note by Mike (Mav): Two posts released from Spam Filter and duplicate post removed.

[#4]

Did not get any today, though found out that support had turned off email to my account so that NOTHING comes through.

I was notified that it was my account that has been compromised and being used to spam others.

Could be true but I am not too sure about this and I have asked for a screenshot to show this as I changed my password in the midst of it all happening and was still getting email (delivery failure)  bombed.

I have switched it back on and will monitor for the next day or so.

[#5]

---

@Mav wrote:

@Chris

Just checked my emails and got over 650 spam ones. Most were marked as SPAM but of the few that weren't I've sent two headers by PM.

---

Just got home after a few hours shopping and there were another 350 or so emails waiting for me. Nice to be so popular

[#6]

I received some spam emails yesterday, I deleted them.

[#7]

And another 100!

Thankfully most end up in the junk folder so a simple CTRL-A then Delete is all it takes

[#8]

For those receiving the backscatter email/failed delivery notices, I can't say if there's any merit in the suggestion that your accounts may have been compromised, as I'm not in the office to check. Assuming it's not the case, if a spammer has been sending mail from your address then this can happen from time to time, and I'm afraid there's little we can do on a per customer basis, other than to ask you to wait it out (if your account isn't compromised, it *will* stop).

There have been a number of high profile issues recently affecting non-Plusnet services that may mean your address has ended up in the wrong hands. Going a bit off topic, but I personally recommend using this website to stay on top of things like this that may affect you - https://haveibeenpwned.com

For those of you receiving increased volumes of actual spam, rather than failed delivery reports, are you able to check the email headers and see if there's any consistency in the inbound server that's receiving the spams? You're looking for reference to an 'avasinXX.plus.net' server, where the XX will be a number. A few of these servers are running newer software, and I'm wondering if that's anything to do with it?

[#9]

I've seen a flurry of the brain building email spam over the weekend to my own domain but nothing to my Plusnet address.

[#10]

It seems like some of us have had the same email, done what they've asked and still have no email access.

Any idea as to how long the blocks will be in place? @bobpullen? Anyone?

[#11]

@VeganRunner - Do you have a full email block placed on your mail? (have I understood this correctly?)  If this is the case, try disabling it and seeing it the spam emails are still coming through. The support team placed one on my account and I disabled it last night and so far I haven't received any.

[#12]

---

@bobpullen wrote:


There have been a number of high profile issues recently affecting non-Plusnet services that may mean your address has ended up in the wrong hands. Going a bit off topic, but I personally recommend using this website to stay on top of things like this that may affect you - https://haveibeenpwned.com

For those of you receiving increased volumes of actual spam, rather than failed delivery reports, are you able to check the email headers and see if there's any consistency in the inbound server that's receiving the spams? You're looking for reference to an 'avasinXX.plus.net' server, where the XX will be a number. A few of these servers are running newer software, and I'm wondering if that's anything to do with it?

---

@bobpullen

The address of mine receiving the actual spam is clean on the site you linked to - so I'm 'safeish' as regards that.

As regards the 16 spam I have received to date, there does not seem to be just one server involved - my count as follows:

19 - 2 spam, 16 - 4, 03 - 2, 11 - 2, 08 - 1, 14 - 1, 18 -1, 09 -2 & 17 -1.

[#13]

@GioC Thanks for that. I had no idea that I could unblock myself. Done now.

[#14]

I'll probably pay for saying this, but my admittedly small number of spam emails seems to be getting smaller over the last couple of days - anyone else seeing the same?

[#15]

I was hesitating about saying the same! The volume has reduced, although I've had a flurry from Plusnet yesterday saying they've quarantined messages. However, none this morning so far so fingers crossed.