cancel
Showing results for 
Search instead for 
Did you mean: 

Plusnet phishing email?

NorthPole
Aspiring Pro
Posts: 255
Thanks: 39
Fixes: 6
Registered: 05-07-2013

Plusnet phishing email?

I was surprised to receive an email this morning purporting to be from Plusnet, claiming that the 'forgot password' function had been applied to my account. Needless to say, it hadn't - at least not by me! On looking directly at my Forum account details (NOT going via the link in the email), I can see no evidence of this and no message about this matter. I therefore suspect the email is a fake, and am happy to forward it to a member of Plusnet staff for examination if they would like to PM me. Here's what the email says (suitably edited):
"New password for Forum
This mail was sent because the 'forgot password' function has been applied to your account. To set a new password click the following link:
link redacted
IP: redacted
Username: NorthPole
Regards,
The Forum Team.
--
PlusNet plc
Registered Office: The Balance, 2 Pinfold Street, Sheffield, S1 2GU
Registered in England no: 3279013
VAT registration number: 842254440"
8 REPLIES
Community Veteran
Posts: 26,686
Thanks: 910
Fixes: 10
Registered: 10-04-2007

Re: Plusnet phishing email?

Is the IP your IP?
If not, it's a long shot but you could try looking up the IP to see if it tells you the user name (or even if the IP is on Plusnet).
jelv (a.k.a Spoon Whittler)
   Why I have left Plusnet (warning: long post!)   
Broadband: Andrews & Arnold Home::1 (FTTC 80/20)
Line rental: Pulse 8 Home Line Rental (£13/month)
Mobile: iD mobile (£4/month)
NorthPole
Aspiring Pro
Posts: 255
Thanks: 39
Fixes: 6
Registered: 05-07-2013

Re: Plusnet phishing email?

Nothing like it; the IP in the email starts with 212, whereas mine (which is not fixed BTW) currently starts with 146 according to DNSGoodies.com.
pwatson
Rising Star
Posts: 2,468
Thanks: 8
Fixes: 1
Registered: 26-11-2012

Re: Plusnet phishing email?

This doesn't sound like a phishing attempt to me - Just someone trying to get into the forum using your username and clicking on the 'forgot password' link.  It isn't even necessarily malicious intent either - Perhaps another PN user uses the username 'NorthPole' on other forums and thought they'd registered here with that name as well?
All would be clear if you hadn't redacted the link of course... Wink
NorthPole
Aspiring Pro
Posts: 255
Thanks: 39
Fixes: 6
Registered: 05-07-2013

Re: Plusnet phishing email?

True, but thinking it might be malicious, I thought better not to!
Superuser
Superuser
Posts: 9,577
Thanks: 950
Fixes: 54
Registered: 06-04-2007

Re: Plusnet phishing email?

I suggest forwarding the suspecious email *as an attachment* to abuse@plus.net. That should get it to the correct team.
David
ScottStorey
Aspiring Pro
Posts: 376
Thanks: 71
Fixes: 1
Registered: 21-02-2013

Re: Plusnet phishing email?

That's the standard mail format for password resets requested via the forum.
Wouldn't hurt to send it to abuse@plus.net though so we can have a second look in case it was copied and spoofed (although I think that is very unlikely)
Community Veteran
Posts: 26,686
Thanks: 910
Fixes: 10
Registered: 10-04-2007

Re: Plusnet phishing email?

There is a Plusnet user with the user name northpole who's on a fixed IP (not the OP as I've asked him). If the IP address was 212.159.72.156 it probably means that user tried to log in to these forums using his Plusnet user name.
Does SMF keep a log of failed login attempts and if so can the moderators see it?
jelv (a.k.a Spoon Whittler)
   Why I have left Plusnet (warning: long post!)   
Broadband: Andrews & Arnold Home::1 (FTTC 80/20)
Line rental: Pulse 8 Home Line Rental (£13/month)
Mobile: iD mobile (£4/month)
NorthPole
Aspiring Pro
Posts: 255
Thanks: 39
Fixes: 6
Registered: 05-07-2013

Re: Plusnet phishing email?

Quote from: Scott
Wouldn't hurt to send it to abuse@plus.net though so we can have a second look in case it was copied and spoofed (although I think that is very unlikely)

Well, I did that last week and have had absolutely no response whatever from Plusnet; so it seems they just can't be bothered to look at it.
I had a similar experience with PayPal - I recently received a suspect email claiming to be from them, forwarded it to their Abuse section who promise to individually notify you whether it's a fake or genuine, and just had a standard automated email in response. So it seems that internet organisations aren't really concerned at all about spoof emails using their name.