Plusnet Spam

Just received 2x spam messages to an email address only ever used to sign up and manage one of my PlusNet accounts.

Anyone else?


Regards
Tam

No. The PlusNet spam filtering is pretty good.

Discussed and investigated here http://community.plus.net/forum/index.php/topic,1339...

Ahh .. thank you - will wander over in that direction ..

Me too, also to an MAAF-only address, I've posted in the Community forum.

Wondered why I was getting emails to an address I used to setup my uncle's PlusNet account. It has never been used for anything else but suddenly started getting spam recently - sounds like PlusNet have had one of their address lists/databases leaked.

Doesn't look like they have stated what has caused it yet. Suspect I will have to sin-bin the address and just delete anything coming in to it.

I have just added a post to the Community Forum thread requesting some more input from Plusnet, even if it's only "we're still looking into it" as they have gone rather quiet. For me, at least, they seemed to have stopped for now.

In reply to a post by Oldjim:

Discussed and investigated here http://community.plus.net/forum/index.php/topic,1339...

Interesting. I give all my contacts a unique name but PN is an exception. I gave them my gmail account because if my connection fails my own server will be no use. I've not had any spam yet, though.

Something to consider for that discussion (and for those getting hot under the collar) is that investigating spam from email headers is difficult because pretty much anything in an email header can be faked.

http://en.wikipedia.org/wiki/Email_spoofing

It depends on the server implementation as to how closely the headers are examined but as long as the formatting is correct most are unlikely to bleat. Some of the really low-spec ones may not even bother checking header formatting and will just dump whatever is uploaded into the specified mailbox(es).

The only people who really know what machine sent the email are those of us with access to server logs. We can track the RCPT entries and know for sure what IP address issued the command.

http://www.cs.cf.ac.uk/Dave/PERL/node177.html

Although these days it could still be some innocent victim that has been hijacked.

Edited by Andrue (Mon 24-Nov-14 14:56:21)

Hi guys,

I've just posted a response over on the Plusnet Community thread.

It would help my sanity if discussion about the topic could be kept to one place though

Rgds,