cancel
Showing results for 
Search instead for 
Did you mean: 

Another phishing email apparently from "Plusnet"?

EmpireCad2
Newbie
Posts: 3
Registered: ‎09-08-2018

Another phishing email apparently from "Plusnet"?

Yesterday received another suspicious looking email apparently from "Plusnet" with the heading "Keeping your Plusnet account secure".  I always look at dodgy looking emails by using Ctrl+U rather than opening them.  The message part of this one is as follows:

 

 Plusnet
Advice on how to avoid phishing scams.

If you can=E2=80=99t see this email, click here http://comm.plus.net/q/17He=
NJwIspuHHi25zTfEzI/wv

Plusnet
http://comm.plus.net/c/1OByKjRUEPk6fp7oRHpNKUpkH

Hello,

At Plusnet we take the security of our customers very seriously and we want=
 to make sure you are aware of how to protect yourself from potential 'phis=
hing' scams.

What is phishing?

Phishing is a technique used by cyber criminals to coerce customers into di=
sclosing sensitive information such as passwords. Phishing is an email or w=
ebsite that poses as a company or brand you recognise. Phishing emails are =
becoming more and more convincing, so you need to be wary every time you op=
en an email with links, attachments or requests for personal information. T=
hese are some of the tell-tale signs to look out for:
Asking for personal information - sending a link and asking for you to inpu=
t your full password.

Asking you to click on a link - emails that require you to click on a link =
should be approached with caution. Hover over the hyperlink to reveal the U=
RL to ensure that it is legitimate. If in doubt, contact the company or sen=
der direct.

Prizes and offers - if it=E2=80=99s too good to be true, it probably is. Ph=
ishing emails promise everything from free mobile phones and expensive gadg=
ets to large cash sums.

Spelling mistakes - spelling or grammatical errors should ring alarm bells =
straight away. But remember that some of the more sophisticated scams won=
=E2=80=99t have these oversights.

Deadlines - some scams work by creating a sense of urgency, threatening the=
 closure of an account or suspension of membership.

Unusual attachments - if there is an attachment that you didn't expect, it =
could be a sign that it=E2=80=99s a phishing email. Do not open any attachm=
ents unless you know the sender and are expecting to see one.

What should I do?

By checking the sender's email address, you should be able to tell whether =
it is real. If you are still unsure, do not open or click on anything. If y=
ou are worried that you have clicked on a phishing link, the best advice is=
 to change your Plusnet password. You can do this by visiting the Plusnet w=
ebsite and following these steps:
Click on the 'my account' tab at the top of the Plusnet home page and choos=
e the Broadband option

Login in to Member Centre using your username

Click on the 'Manage Account' option at the top

Click on 'Account Details'

Choose the 'change password' option to reset your password

If you would like any more information, we have a helpful guide to staying =
safe online on the help and support section on the Plusnet website.

Best Wishes,

The Plusnet Team

Click here http://comm.plus.net/q/17HeNJwIspuHHi25zTfEzI/wv to view this em=
ail in a new window

This email has been sent because it contains important information about yo=
ur service from Plusnet. Please don=E2=80=99t reply to this email as it is =
from an unmonitored address.

Email ref: PHEM01

Plusnet plc
Registered Office Address: The Balance, 2 Pinfold Street, Sheffield, S1 2GU
Registered in England, No: 3279013=


I have seen previous posts asking for suspect emails to be forwarded to abuse at plus.net and spam at spamtraining.plus.com but always as an attachment and mention of including the header.  Sorry if I'm being slow here but can someone explain in simple terms exactly how to do these two things?

And is the email above phishing or am I being paranoid about my main/default email address finally being hooked in by the phishers after over a decade and a half with PlusNet?

All advice gratefully received.

Regards

EmpireCad

 

21 REPLIES 21
Chris
Legend
Posts: 17,724
Thanks: 600
Fixes: 169
Registered: ‎05-04-2007

Re: Another phishing email apparently from "Plusnet"?

That looks like a legitimate email. The comm.plus.net address is one used often and checking the content of the email there doesn't seem to be anywhere that it's asking for any personal details, login details etc

 

I believe we've sent this as an informational message.

Former Plusnet Staff member. Posts after 31st Jan 2020 are not on behalf of Plusnet.
Alex
Community Veteran
Posts: 5,500
Thanks: 921
Fixes: 13
Registered: ‎05-04-2007

Re: Another phishing email apparently from "Plusnet"?

It looks ok, the links appear to be to PlusNet however one thing which makes me suspicious if I try:

http://comm.plus.net/c/1OByKjRUEPk6fp7oRHpNKUpkH

It just redirects me to the general PlusNet help pages, so I don't know if it is account or e-mail specific.

Also Phishing e-mails can contain links with the text disgusted as the actual link.

The fact it is suggesting you change your password is a bit worrying, but it is not providing a suspicious link to try and capture your old password.

There should be no attachment, and to forward the headers it depends on what device you are using. e.g. PC/Mac/Mobile/Tablet, and what e-mail software or web client you are using to use your e-mail. If you let someone know I am sure they can advise.

EmpireCad2
Newbie
Posts: 3
Registered: ‎09-08-2018

Re: Another phishing email apparently from "Plusnet"?

Thanks for your comments Chris and Alex.  I have just opened the email normally and it does indeed look genuine.  HOWEVER, PlusNet always communicate with me via my Postmaster @ etc email address and always address me by name so I am still suspicious.  Can someone from PN staff please advise if this is from PN or not?

As regards how to send the whole email as an attachment with full header, I am on a PC using Mozilla Thunderbird.

Regards

EmpireCad

22over7
Rising Star
Posts: 78
Thanks: 22
Registered: ‎07-04-2016

Re: Another phishing email apparently from "Plusnet"?

@EmpireCad2

I found this on the web (never tried it myself...)

Thunderbird

  • From the menu at top select View > Headers > All.
  • Navigate to and highlight the message in question
  • Select the Forward button.
  • Enter the email address of the person to whom you are sending the message in the To: field.
  • Send the message.
  • Once you have successfully forwarded the message with full headers be sure to switch back to 'normal headers by selecting View > Headers > Normal.                                                                          
EmpireCad2
Newbie
Posts: 3
Registered: ‎09-08-2018

Re: Another phishing email apparently from "Plusnet"?

Many thanks, 22 over7.  I have now forwarded the suspicious email to the abuse and spamtraining addresses mentioned elsewhere but not as attachments as requested.  Any help out there as to how to do that please?

EDIT: Sorry, have just been lazy here.  I now see how to do this in Thunderbird: Message > Forward as > Attachment.  DOH!

I notice that some of the letter combinations in the "Reply to" address spell "...buy...sex..."

And can someone in PN please verify this email as theirs or is it phishing?

Regards

EmpireCad2  (formerly just EmpireCad)

TheMightyAJ
Plusnet Alumni (retired)
Plusnet Alumni (retired)
Posts: 2,511
Fixes: 126
Registered: ‎26-03-2018

Re: Another phishing email apparently from "Plusnet"?

Hi @EmpireCad2,

Just to confirm, the email included in the original post does indeed appear to be from us.

If this post resolved your issue please click the 'This fixed my problem' button
 Alex H
 Plusnet Help Team
Luzern
Hero
Posts: 4,823
Thanks: 872
Fixes: 9
Registered: ‎31-07-2007

Re: Another phishing email apparently from "Plusnet"?


@EmpireCad2 wrote:

Thanks for your comments Chris and Alex.  I have just opened the email normally and it does indeed look genuine.  @HOWEVER, PlusNet always communicate with me via my Postmaster @ etc email address and always address me by name so I am still suspicious.  Can someone from PN staff please advise if this is from PN or not?

As regards how to send the whole email as an attachment with full header, I am on a PC using Mozilla Thunderbird.

Regards

EmpireCad


I am suspicious for like reasons. Both the "comm" in the from and the fact that other phishers have been addressed to my wife's inbox is very disturbing, as also is the fact that all passwords were changed after the first suspicious mail.

No one has to agree with my opinion, but in the time I have left a miracle would be nice.
Luzern
Hero
Posts: 4,823
Thanks: 872
Fixes: 9
Registered: ‎31-07-2007

Re: Another phishing email apparently from "Plusnet"?

@TheMightyAJ  I would hope you or your colleagues can give a believable explanation why some emails from, or purporting to originate from Plusnet are addressed to may wife@username.plus.com, whilst others, like those today about my service change are properly addressed to username@username.

And I have checked my email settingsSmiley Seems to me, in my innocence, something PN end is boxed and coxedRoll_eyesGrin

No one has to agree with my opinion, but in the time I have left a miracle would be nice.
Gandalf
Community Gaffer
Community Gaffer
Posts: 26,563
Thanks: 10,265
Fixes: 1,599
Registered: ‎21-04-2017

Re: Another phishing email apparently from "Plusnet"?

Hey all.

Firstly Chris is staff just like me and Alex, it looks like there seems to be some confusion above. Smiley

I would hope you or your colleagues can give a believable explanation why some emails from, or purporting to originate from Plusnet are addressed to may wife@username.plus.com, whilst others, like those today about my service change are properly addressed to username@username.

This is likely just because the emails we send directly from your account come from a different mailbox and are sent via a different way than the comm.plus.net mailbox.

From 31st October 2022, I no longer have a regular presence here as I’ve moved on to a new role.
Anoush Mortazavi
Plusnet
Alex
Community Veteran
Posts: 5,500
Thanks: 921
Fixes: 13
Registered: ‎05-04-2007

Re: Another phishing email apparently from "Plusnet"?

Thanks Gandalf,

I thought it was a legitimate e-mail from yourselves, sorry for the criticism.

Also I understand businesses want to communicate with their customers, but in this day and age you can never be too careful.

Gandalf
Community Gaffer
Community Gaffer
Posts: 26,563
Thanks: 10,265
Fixes: 1,599
Registered: ‎21-04-2017

Re: Another phishing email apparently from "Plusnet"?

No problems. Yeah I appreciate the caution.

Let us know if you have any further queries.

From 31st October 2022, I no longer have a regular presence here as I’ve moved on to a new role.
Anoush Mortazavi
Plusnet
Townman
Superuser
Superuser
Posts: 22,919
Thanks: 9,536
Fixes: 156
Registered: ‎22-08-2007

Re: Another phishing email apparently from "Plusnet"?

@Gandalf,

I think an important point (question) is being missed here.

Why is Plusnet emailing secondary email addresses - regardless of where they are being sent from?

The only legitimate email addresses are the default address and any additional notification email address added by the user.

@Luzern wife@ has not been added as an additional email address ... has it?

Superusers are not staff, but they do have a direct line of communication into the business in order to raise issues, concerns and feedback from the community.

MauriceC
Resting Legend
Posts: 4,085
Thanks: 929
Fixes: 17
Registered: ‎10-04-2007

Re: Another phishing email apparently from "Plusnet"?

Top marks to PR.  They must have put some effort into making it look like a phising mail Crazy2

Superusers are not staff, but they do have a direct line of communication into the business in order to raise issues, concerns and feedback from the community.

Luzern
Hero
Posts: 4,823
Thanks: 872
Fixes: 9
Registered: ‎31-07-2007

Re: Another phishing email apparently from "Plusnet"?


@Townman wrote:
@Gandalf,

I think an important point (question) is being missed here.

Why is Plusnet emailing secondary email addresses - regardless of where they are being sent from?

The only legitimate email addresses are the default address and any additional notification email address added by the user.

@Luzern wife@ has not been added as an additional email address ... has it?

 @TownmanSorry for no reply, as have suffered both telephony and internet (router) troubles. But answer is 'no'.

No one has to agree with my opinion, but in the time I have left a miracle would be nice.