Plusnet phishing email?

[#1]

I was surprised to receive an email this morning purporting to be from Plusnet, claiming that the 'forgot password' function had been applied to my account. Needless to say, it hadn't - at least not by me! On looking directly at my Forum account details (NOT going via the link in the email), I can see no evidence of this and no message about this matter. I therefore suspect the email is a fake, and am happy to forward it to a member of Plusnet staff for examination if they would like to PM me. Here's what the email says (suitably edited):
"New password for Forum
This mail was sent because the 'forgot password' function has been applied to your account. To set a new password click the following link:
link redacted
IP: redacted
Username: NorthPole
Regards,
The Forum Team.
--
PlusNet plc
Registered Office: The Balance, 2 Pinfold Street, Sheffield, S1 2GU
Registered in England no: 3279013
VAT registration number: 842254440"

[#2]

Is the IP your IP?
If not, it's a long shot but you could try looking up the IP to see if it tells you the user name (or even if the IP is on Plusnet).

[#3]

Nothing like it; the IP in the email starts with 212, whereas mine (which is not fixed BTW) currently starts with 146 according to DNSGoodies.com.

[#4]

This doesn't sound like a phishing attempt to me - Just someone trying to get into the forum using your username and clicking on the 'forgot password' link.  It isn't even necessarily malicious intent either - Perhaps another PN user uses the username 'NorthPole' on other forums and thought they'd registered here with that name as well?
All would be clear if you hadn't redacted the link of course...

[#5]

True, but thinking it might be malicious, I thought better not to!

[#6]

I suggest forwarding the suspecious email *as an attachment* to abuse@plus.net. That should get it to the correct team.

[#7]

That's the standard mail format for password resets requested via the forum.
Wouldn't hurt to send it to abuse@plus.net though so we can have a second look in case it was copied and spoofed (although I think that is very unlikely)

[#8]

There is a Plusnet user with the user name northpole who's on a fixed IP (not the OP as I've asked him). If the IP address was 212.159.72.156 it probably means that user tried to log in to these forums using his Plusnet user name.
Does SMF keep a log of failed login attempts and if so can the moderators see it?

[#9]

Quote from: Scott

Wouldn't hurt to send it to abuse@plus.net though so we can have a second look in case it was copied and spoofed (although I think that is very unlikely)

Well, I did that last week and have had absolutely no response whatever from Plusnet; so it seems they just can't be bothered to look at it.
I had a similar experience with PayPal - I recently received a suspect email claiming to be from them, forwarded it to their Abuse section who promise to individually notify you whether it's a fake or genuine, and just had a standard automated email in response. So it seems that internet organisations aren't really concerned at all about spoof emails using their name.