Scam email - is this where to report this?

[#1]

I just had an email from 'Plusnet Support' - see below.  I assume it's a scam?

Hovering over 'Plusnet Support' I see it's from 'ojuaqicz@circa.ca'.

Have they got my email name by stealing it from Plusnet????

Dear -----------.plus.com, Security notification. Date IP Address IP Address 2 Browser 8/8/2018 5:30:13 p.m. xxxxxxxx xxxxxxxx Mozzila Firefox         8/8/2018 5:30:13 p.m. IP address of your previous login differs from current IP address. Previously you logged in from United States. Now you`re trying to logon from [deleted by me], (Antwerpen , Belgium). If previous login was yours, then ignore this message. If it was not, then it means that someone tries to access your account. Please [link deleted by me] in order to avoid account suspension. Thanks, Plusnet

[#2]

I've had the same, which I emailed to abuse@plus.net, which I found on another forum post,

Plusnet, why isnt this email address on your contact page?

[#3]

Yes I have just had a very similar email, which I deleted

[#4]

Unfortunately abuse@plus.net won't accept any emails: "message rejected due to spam or virus". Don't really know why PlusNet have that account as it never works 😞

[#5]

Gordon Bennett, neither does help@plus.net, same error message 😞

Hi PlusNet - To whom should we report/send these obvious scam mails?

[#6]

Hello Everyone,

With "abuse@plus.net" now being full please forward any emails that you get like the above example from @SkylineUK_Dup to spam@plus.net

Thank You

Samir

[#7]

I've not had an error message for either.  But trying to contact Plusnet about ANYTHING is getting worse.  I joined because customer services were so receptive.  No longer the case I'm afraid.

[#8]

Same email here.  Begins to look like Plusnet have had a lot of customers personal details stolen?  As others have said, there should be an obvious option on the Plusnet homepage to report this sort of thing.

[#9]

Just had this same email and am concerned.

Every time I try and report it to Plusnet it bounces back.

Return-path: <steinar.bottenvik@kleppnett.no>
Envelope-to: xxxxxx.plus.com
Delivery-date: Wed, 08 Aug 2018 19:18:45 +0100
Received: from [212.159.8.109] (helo=avasin01.plus.net)
by inmx07.plus.net with esmtp (PlusNet MXCore v2.00) id 1fnT2j-0001np-Rn
for xxxxxxx.plus.com; Wed, 08 Aug 2018 19:18:45 +0100
Received: from asav22.altibox.net ([109.247.116.9])
by Plusnet Cloudmark Gateway with ESMTP
id nT2hfTLw3TVrwnT2jfsBV0; Wed, 08 Aug 2018 19:18:45 +0100
X-CM-Score: 0.00
X-CNFS-Analysis: v=2.3 cv=bL843s2Z c=1 sm=1 tr=0
a=1ZlH2MM9a0cqs7Ub35Q/XQ==:117 a=09klws+YLA29M2uUnvMrOQ==:17
a=dapMudl6Dx4A:10 a=FP90t5_ZAAAA:8 a=3dCR_uhHynkIeAsp2rgA:9
a=P3sBtmUEe4hdGGUO:21 a=iXDm6FZB4eAua9Y-:21 a=wPNLvfGTeEIA:10
a=RKYsMBYK4xYA:10 a=TOhbn6bSun8A:10 a=xfG-7ku_-8Q9_PNJwsgA:9
a=ZolHXsoCBl8Fq5Kw:18 a=KQqxNPgzF0kA:10 a=ZByWJaF0i05YPZD5qnP6:22
Received: from smtp.ebnett.no (74.227.198.146.dyn.plus.net [146.198.227.74])
(using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))
(No client certificate requested)
(Authenticated sender: steinar.bottenvik@kleppnett.no)
by asav22.altibox.net (Postfix) with ESMTPSA id D56F52024C
for <xxxxxxxxx.plus.com>; Wed, 8 Aug 2018 20:18:42 +0200 (CEST)
From: "Plusnet Support" <qujiwju@cira.ca>
To: xxxxxxxxxxx.plus.com
Date: 08 Aug 2018 18:18:41 -0700
Message-ID: <20180808181841.7037D64E34F6809F@cira.ca>
MIME-Version: 1.0
Content-Type: multipart/related;
boundary="----=_NextPart_000_0012_29155299.499739FA"
X-CMAE-Score: 0
X-CMAE-Analysis: v=2.3 cv=C9zHNzH+ c=1 sm=1 tr=0
a=09klws+YLA29M2uUnvMrOQ==:117 a=09klws+YLA29M2uUnvMrOQ==:17
a=FP90t5_ZAAAA:8 a=3dCR_uhHynkIeAsp2rgA:9 a=P3sBtmUEe4hdGGUO:21
a=iXDm6FZB4eAua9Y-:21 a=wPNLvfGTeEIA:10 a=RKYsMBYK4xYA:10 a=TOhbn6bSun8A:10
a=xfG-7ku_-8Q9_PNJwsgA:9 a=ZolHXsoCBl8Fq5Kw:18 a=KQqxNPgzF0kA:10
a=ZByWJaF0i05YPZD5qnP6:22
X-CMAE-Envelope: MS4wfL6cPh17tZTGA084DiZpVqLFB7htnh81+4HwigVJbokuphYm3CrE0LukwehqwzmtUgBgn7Wo+s01pOGJGif1NTqoqtSMd4aeMvFzFImVgIPbB/8CFbV0
UQY08MIK5zdbekGnY06DyWK/K16WImWhQuSC+1LGSjJ86H2MPco4j4W9YyA9ojzEGPCgdhBK9R/+mD7DN70CdxACcD+KvVW2+Pg=
X-PN-Virus-Filtered: by PlusNet MXCore (v5.00)
X-PN-Spam-Filtered: by PlusNet MXCore (v5.00)
Subject: [Online Support Announcement] - Action required - Review this email
X-BitdefenderWKS-SpamStamp: Build: [Engines: 2.15.8.1169, Stamp: 3],
Multi: [Enabled, t: (0.000006,0.003523)], BW: [Enabled, t:
(0.000006)], RTDA: [Enabled, t: (0.445365), Hit: No, Details: v2.7.13;
Id: 15.1i6aoh6.1ckdm2gah.aovj], total: 0(775)
X-BitdefenderWKS-Spam: No - 0

[#10]

Same error message back from spam@plusnet now too 😞

Come PlusNet, please give us a working email address that we can forward these scam emails to so that you can do something about them.

[#11]

Plusnet is aware of these emails and will be looking to put a stop to this. For now people are being asked to forward the emails they get to spam@plus.net

[#12]

It may be due to that now being full too, if further information is to be released I will looking to provide an update on here

[#13]

Three questions to those who have received these emails...

1. Were they addressed to @Username.plus.com ?

2. Where the addresses to postmaster@ or username@ as opposed to a specific additional email box

3. Do those who have received them have fixed or dynamic IP addresses?

[#14]

In my case:

1. Yes.  So it must have been stolen from Plusnet.

2. To my main (and only, in my case) 1. above.

3. I don't know the answer to that. As an ordinary home, user I assume fixed?

[#15]

Thanks Skyline

1. There’s is yet no grounds for asserting the source of it being ‘stolen’ @Username.plusnet.com can be inferred from other data
2. If catchall is enabled anything@ will be received
3. If you don’t know you are most likely on a dynamic IP

Will be interesting to see what others report.