"Copyrighted content email" - getitright gets it wrong

[#1]

Last Friday I received a warning about copyright content supposedly being uploaded.

However when I follow your supplied link to your own getitright/activity page, I am told that "I don't currently have any active infringements".

So - was there or was there not any copyright infringing activity from my line ? Clearly your "get it right" system has got something wrong, but was it wrong in sending out the accusing email, or is it wrong in now claiming that it did not make an accusation ?

[#2]

Ignore it anyway - there is not much they can really do.

Also it could be a new phising e-mail, pretending to be something it is not.

You could post the full e-mail headers to abuse@plus.net, but probably not much they can do either about it. The chances are someone else could have received a fake e-mail.

[#3]

Hi @nickleverton2

Thanks for getting in touch. I'd be tempted to agree with @Alex here - the email may have been sent in error, or, may not have been from ourselves.

Could you possibly paste a copy of the email here (blanking out any identifying information) and we'll take a look?

Best wishes,

Dave

[#4]

Ok, thanks @RandallFlagg. Tthe headers are quoted below.  Seem to be legitimate apart from the illegal use of 8-bit data in the Subject header, although, with no SPF or DKIM entry and no header signing, the email doesn't really make any attempt to provide assurance as to its origin.

I do want to know whether  there was really a copyrighted upload from my line, and when, so that if needs be I can make enquiries of my visitors over the last week and try to identify the culprit.

Received: from avasout04.plus.net (HELO avasout04.plus.net) (212.159.14.19)
by leverton.org (qpsmtpd/0.84) with (ECDHE-RSA-AES256-GCM-SHA384 encrypted) ESMTPS; Fri, 31 Aug 2018 13:47:24 +0100
Received: from workplace04.servers.plus.net ([84.93.207.83])
by smtp with ESMTP
id vipdfhevPI9T1vipef9vlI; Fri, 31 Aug 2018 13:47:22 +0100
X-CM-Score: 0.00
X-CNFS-Analysis: v=2.3 cv=Z6vC4kZA c=1 sm=1 tr=0
a=Z7BomkclHqCcUzvv6AHSDg==:117 a=dapMudl6Dx4A:10 a=0Bzu9jTXAAAA:8
a=mrsOzNvoAAAA:8 a=mLO0zszptTz6K4TBnLYA:9 a=jlPyvyz7gTFLAJgS:21
a=4VNSZgkahGzbaSfo:21 a=QEXdDO2ut3YA:10 a=JqEG_dyiAAAA:8 a=3j4BkbkPAAAA:8
a=vnREMb7VAAAA:8 a=tdcr7EiTAAAA:8 a=SSmOFEACAAAA:8 a=Dl2iQcBPoU2s4KDa9hkA:9
a=-Ha2qcWvfBJXFR5w:21 a=5xbR_GTytkF4RRHz:21 a=JbO11dBlPr17h5ai:21
a=vPgCiNuFOdoA:10 a=8n1SDsDCGFYA:10 a=yHzx7pnGWE0WXkbkht9p:22
a=kKB9S4uSJ34BVPySD5Nw:22 awl=host:11159
Received: from www-data by workplace04.servers.plus.net with local (Exim 4.84_2)
(envelope-from <www-data@workplace04.servers.plus.net>)
id 1fvipd-0005HD-6U
for nick@leverton.org; Fri, 31 Aug 2018 13:47:21 +0100
To: nick@leverton.org
Subject: Copyrighted content email – please read
From: Plusnet Support <support@plus.net>
X-Mailer: PlusNet-System-Email-Handler
MIME-Version: 1.0
Content-Type: multipart/alternative; boundary="fw-body-d886048c74fe61b5f1ae2eb907dce282"
Message-Id: <E1fvipd-0005HD-6U@workplace04.servers.plus.net>
Sender: www-data <www-data@workplace04.servers.plus.net>
Date: Fri, 31 Aug 2018 13:47:21 +0100
X-CMAE-Envelope: MS4wfLFpbeh56a7dgKdOfPDVWWz4tE4G1rw+3ds801srVJweO+zL/NTr9iL24v+zGx2OqezY84z4JBizXnNvFMiZP36gGwmMW5tVUiyEgXKMiaEo8RP9UwHZ
+Kg7crFOnAdq9kKHFoABlxmMZeZ56ko+Idik6RxLu2+B+yiHLsIVKpZeZ63I6xLqzmm8F7jrCHt2Di0sQvSSRKqPGQUiU3ZKAUE=

[#5]

Thanks for this. 

The email itself looks to be sent from us. 

Does the content of the email advise anything below the "What has my Internet connection been used for?" heading?

Also could you send me a PM with a screenshot of where it says "I don't currently have any active infringements".

[#6]

Hi @Gandalf

Yes I should have given you the reference also, sorry. This doesn't seem to contain all the information that I've seen others post when querying the getitright message though - protocol is missing for a start.

Title: STAR WARS: THE LAST JEDI (2017)

Date: 29/08/2018
Time: 18:55:37
Reference: 21154584

Screenshot of the web page is also attached.  Not sure why the website keeps saying that I haven't got functional cookies enabled, I'm intending to raise that error as a separate issue.

[#7]

Sorry for the delayed response.

It's odd and I'm not sure I can explain this so I've raised a query with our infrastructure engineers/networks guys for help.

I'll let you know when I've got a response which should be within the next few days.

[#8]

Thanks, I will appreciate that.

I hope, if the router CPU proves to be fast enough, to be able to configure connection logging so I can narrow it down further if it happens again. The getitright info will be essential to correlate against the logs. I don't believe my visitors would do copyright movie sharing so I suspect one of them must have a compromised device, which I would like to identify and get off my network But it greatly helps to know what one is looking for !

On the other note I think that the "functional cookies" thing seems to be a browser issue with my day-to-day browser which is quite old now. It works in current Firefox ESR, I'm not hassled to enable cookies, so I guess there is some JS behind your cookie management which the older browser doesn't handle correctly. I'll leave that one until I get time to upgrade the old system.

[#9]

No worries.

I'll let you know when I hear back.