User comments on ISPs
>> PlusNet plc

Pages in this thread: 1 | 2 | (show all)

Print Thread

deleted
(deleted) Wed 03-Dec-14 11:26:24

SPAM Help Please - PN Staff?

[link to this post]

Hello,

I'm not with PlusNet (used to be but not since (Mr Potesta's time infamous outburst)

I've since put quite a few people on plusnet and had set up email accounts (purely for this and each unique). Now I am receiving copious quantities of SPAM from these addresses. No one know these except PlusNet. Have plusnet sold user info or have they been compromised? What can be done to sort this. I really need some decent response here, I'll not be putting anyone else in PN direction unless this is sorted smile

Thanks for any help

deleted
(deleted) Wed 03-Dec-14 12:05:01

Re: SPAM Help Please - PN Staff?

[re: deleted] [link to this post]

You're not alone. See the thread Plusnet Spam in this forum.

kasg
(fountain of knowledge) Thu 04-Dec-14 10:11:19

Re: SPAM Help Please - PN Staff?

[re: deleted] [link to this post]

In reply to a post by smiffy12:
I've since put quite a few people on plusnet and had set up email accounts (purely for this and each unique). Now I am receiving copious quantities of SPAM from these addresses. No one know these except PlusNet.

I presume you mean to these addresses. As MCM said, you are not alone and there is a long thread going in the Community Forum, linked to from the other TBB post. Needless to say there is a lot of ranting and irrelevant stuff on it and, from the responses from Plusnet so far, it is looking increasingly unlikely that they will get to the bottom of it. However, any leak should only be of addresses already supplied to Plusnet, if there were still a "hole" through which future addresses could be leaked, that would be very serious. In my case, the quantity of spam has been fairly limited and manageable (and I can shut down the email addresses in any case if I want to) and all of it has been from the same source (but from various different domains), Gamer SEO, in New Jersey.

Kevin

plusnet Unlimited Fibre - sync approx 60000/20000 at 450m - BQM
Using OpenDNS
Domains and web hosting with TSOHOST

Edited by kasg (Thu 04-Dec-14 10:11:53)

ian72
(eat-sleep-adslguide) Thu 04-Dec-14 14:04:56

Re: SPAM Help Please - PN Staff?

[re: kasg] [link to this post]

I had the spam for about a week but haven't had any for at least a week now. Odd for it to stop like that.

kasg
(fountain of knowledge) Thu 04-Dec-14 16:31:15

Re: SPAM Help Please - PN Staff?

[re: ian72] [link to this post]

Same here, almost, got them for a week, then nothing for about two weeks, then one odd one.

Kevin

plusnet Unlimited Fibre - sync approx 60000/20000 at 450m - BQM
Using OpenDNS
Domains and web hosting with TSOHOST

XRaySpeX
(eat-sleep-adslguide) Thu 04-Dec-14 19:50:16

Re: SPAM Help Please - PN Staff?

[re: ian72] [link to this post]

In reply to a post by ian72:
I had the spam for about a week but haven't had any for at least a week now.

Did the spam say something like 'test message'? I had similar sent to my banking email addys. Guess they are testing in preparation for phishing.

1999: Freeserve 48K Dial-Up => 2005: Wanadoo 1 Meg BB => 2007: Orange 2 Meg BB => 2008: Orange 8 Meg LLU => 2010: Orange 16 Meg LLU => 2011: Orange 20 Meg WBC

kasg
(fountain of knowledge) Thu 04-Dec-14 20:21:05

Re: SPAM Help Please - PN Staff?

[re: XRaySpeX] [link to this post]

In reply to a post by XRaySpeX:
Did the spam say something like 'test message'? I had similar sent to my banking email addys. Guess they are testing in preparation for phishing.

No, those are totally different SPAM messages that were doing the rounds a few weeks back, nothing to do with the Plusnet leak.

Kevin

plusnet Unlimited Fibre - sync approx 60000/20000 at 450m - BQM
Using OpenDNS
Domains and web hosting with TSOHOST

ambrougham
(newbie) Fri 05-Dec-14 02:45:37

Re: SPAM Help Please - PN Staff?

[re: kasg] [link to this post]

I'm sure I registered and posted here donkey's years ago but couldn't seem to find or work out what it was so gave up and am now the proud owner of a shiny new one !

@kasg

It's a somewhat different story to your minimal nuisance factor from a single source here I'm afraid frown

A relatively small (only at the moment of course) but regular stream arriving on an almost daily basis as they clearly attempt to assess the 'quality' of the database they've acquired by one way or another from PN.

A quicky looky see at the stats for November shows the following servers being used and as of December there's an additional bunch of IPs and dodgy domain registrations being used needless to say. Classic spammer tactics and all that, not going to go away anytime soon and can only get worse over time ... unless by some miracle those responsible get caught and shut down before passing on the database they've acquired. Not likely to happen in reality so in short, after suffering all the consequences of the last PN data breach over the past 7+ years, I now have to look forward to several more years of major abuse coming to a network near me solely due to PN screwing up yet again. Suffice it to say I'm a million miles away from being a happy bunny and all that :angry:

Text

IP Address              Reverse DNS LookUp              First Used On
----------              ------------------              ------------- 
138.128.1.75            mx1.liveuknews.co.uk            14th November138.128.1.76            liveuknews.co.uk                18th November
74.221.215.108          ??????                          18th November138.128.146.25          newstorun.com                   19th November
138.128.1.70            mx2.ukbrandnews.co.uk           19th November23.229.2.10             onepoundnews.co.uk              21st November
138.128.1.74            mx2.liveuknews.co.uk            22nd November23.229.2.14             rockmsockmnews.com              25th November
23.229.2.13             bigtimenewstime.com             26th November23.229.2.11             originalknowledgedropper.com    29th November
  
NetRange:       138.128.0.0 - 138.128.127.255CIDR:           138.128.0.0/17
NetName:        B2NETSOLUTIONSNetHandle:      NET-138-128-0-0-1
Parent:         NET138 (NET-138-0-0-0-0)NetType:        Direct Allocation
OriginAS:       Organization:   B2 Net Solutions Inc. (BNS-34)
OrgName:        B2 Net Solutions Inc.OrgId:          BNS-34
Address:        350 Main StreetCity:           Buffalo
StateProv:      NYPostalCode:     14202
Country:        US 
NetRange:       74.221.208.0 - 74.221.223.255CIDR:           74.221.208.0/20
NetName:        DMEHOSTINGNetHandle:      NET-74-221-208-0-1
Parent:         NET74 (NET-74-0-0-0-0)NetType:        Direct Allocation
OriginAS:       AS19194, AS30058, AS3356Organization:   DME Hosting LLC (DHL-28)
OrgName:        DME Hosting LLCOrgId:          DHL-28
Address:        DME Hosting LLCAddress:        P.O. Box 6727
Address:        Chandler, AZ 85246City:           Chandler
StateProv:      AZPostalCode:     85246
Country:        US 
NetRange:       23.229.0.0 - 23.229.127.255CIDR:           23.229.0.0/17
NetName:        B2NETSOLUTIONSNetHandle:      NET-23-229-0-0-1
Parent:         NET23 (NET-23-0-0-0-0)NetType:        Direct Allocation
OriginAS:       AS55286Organization:   B2 Net Solutions Inc. (BNS-34)
OrgName:        B2 Net Solutions Inc.OrgId:          BNS-34
Address:        350 Main StreetCity:           Buffalo
StateProv:      NYPostalCode:     14202
Country:        US

Edited by ambrougham (Fri 05-Dec-14 03:06:12)

deleted
(deleted) Fri 05-Dec-14 10:33:09

Re: SPAM Help Please - PN Staff?

[re: ambrougham] [link to this post]

This is the latest one I've received

"30 second application to reclaim your mis-sold PPI - News"

from

"The Claims Guys" <[email protected]>

kasg
(fountain of knowledge) Fri 05-Dec-14 10:40:08

Re: SPAM Help Please - PN Staff?

[re: deleted] [link to this post]

And uknews4u.co.uk is also registered to Gamer SEO in New Jersey. Maybe someone needs to alert Nominet, perhaps they might have some grounds for blocking these people from registering loads of .uk domain names.

Kevin

plusnet Unlimited Fibre - sync approx 60000/20000 at 450m - BQM
Using OpenDNS
Domains and web hosting with TSOHOST

Pages in this thread: 1 | 2 | (show all)

Print Thread

Jump to