Another phishing email apparently from "Plusnet"?

[#1]

Yesterday received another suspicious looking email apparently from "Plusnet" with the heading "Keeping your Plusnet account secure".  I always look at dodgy looking emails by using Ctrl+U rather than opening them.  The message part of this one is as follows:

 Plusnet
Advice on how to avoid phishing scams.

If you can=E2=80=99t see this email, click here http://comm.plus.net/q/17He=
NJwIspuHHi25zTfEzI/wv

Plusnet
http://comm.plus.net/c/1OByKjRUEPk6fp7oRHpNKUpkH

Hello,

At Plusnet we take the security of our customers very seriously and we want=
 to make sure you are aware of how to protect yourself from potential 'phis=
hing' scams.

What is phishing?

Phishing is a technique used by cyber criminals to coerce customers into di=
sclosing sensitive information such as passwords. Phishing is an email or w=
ebsite that poses as a company or brand you recognise. Phishing emails are =
becoming more and more convincing, so you need to be wary every time you op=
en an email with links, attachments or requests for personal information. T=
hese are some of the tell-tale signs to look out for:
Asking for personal information - sending a link and asking for you to inpu=
t your full password.

Asking you to click on a link - emails that require you to click on a link =
should be approached with caution. Hover over the hyperlink to reveal the U=
RL to ensure that it is legitimate. If in doubt, contact the company or sen=
der direct.

Prizes and offers - if it=E2=80=99s too good to be true, it probably is. Ph=
ishing emails promise everything from free mobile phones and expensive gadg=
ets to large cash sums.

Spelling mistakes - spelling or grammatical errors should ring alarm bells =
straight away. But remember that some of the more sophisticated scams won=
=E2=80=99t have these oversights.

Deadlines - some scams work by creating a sense of urgency, threatening the=
 closure of an account or suspension of membership.

Unusual attachments - if there is an attachment that you didn't expect, it =
could be a sign that it=E2=80=99s a phishing email. Do not open any attachm=
ents unless you know the sender and are expecting to see one.

What should I do?

By checking the sender's email address, you should be able to tell whether =
it is real. If you are still unsure, do not open or click on anything. If y=
ou are worried that you have clicked on a phishing link, the best advice is=
 to change your Plusnet password. You can do this by visiting the Plusnet w=
ebsite and following these steps:
Click on the 'my account' tab at the top of the Plusnet home page and choos=
e the Broadband option

Login in to Member Centre using your username

Click on the 'Manage Account' option at the top

Click on 'Account Details'

Choose the 'change password' option to reset your password

If you would like any more information, we have a helpful guide to staying =
safe online on the help and support section on the Plusnet website.

Best Wishes,

The Plusnet Team

Click here http://comm.plus.net/q/17HeNJwIspuHHi25zTfEzI/wv to view this em=
ail in a new window

This email has been sent because it contains important information about yo=
ur service from Plusnet. Please don=E2=80=99t reply to this email as it is =
from an unmonitored address.

Email ref: PHEM01

Plusnet plc
Registered Office Address: The Balance, 2 Pinfold Street, Sheffield, S1 2GU
Registered in England, No: 3279013=

I have seen previous posts asking for suspect emails to be forwarded to abuse at plus.net and spam at spamtraining.plus.com but always as an attachment and mention of including the header.  Sorry if I'm being slow here but can someone explain in simple terms exactly how to do these two things?

And is the email above phishing or am I being paranoid about my main/default email address finally being hooked in by the phishers after over a decade and a half with PlusNet?

All advice gratefully received.

Regards

EmpireCad

[#2]

That looks like a legitimate email. The comm.plus.net address is one used often and checking the content of the email there doesn't seem to be anywhere that it's asking for any personal details, login details etc

I believe we've sent this as an informational message.

[#3]

It looks ok, the links appear to be to PlusNet however one thing which makes me suspicious if I try:

http://comm.plus.net/c/1OByKjRUEPk6fp7oRHpNKUpkH

It just redirects me to the general PlusNet help pages, so I don't know if it is account or e-mail specific.

Also Phishing e-mails can contain links with the text disgusted as the actual link.

The fact it is suggesting you change your password is a bit worrying, but it is not providing a suspicious link to try and capture your old password.

There should be no attachment, and to forward the headers it depends on what device you are using. e.g. PC/Mac/Mobile/Tablet, and what e-mail software or web client you are using to use your e-mail. If you let someone know I am sure they can advise.

[#4]

Thanks for your comments Chris and Alex.  I have just opened the email normally and it does indeed look genuine.  HOWEVER, PlusNet always communicate with me via my Postmaster @ etc email address and always address me by name so I am still suspicious.  Can someone from PN staff please advise if this is from PN or not?

As regards how to send the whole email as an attachment with full header, I am on a PC using Mozilla Thunderbird.

Regards

EmpireCad

[#5]

@EmpireCad2

I found this on the web (never tried it myself...)

Thunderbird

• From the menu at top select View > Headers > All.
• Navigate to and highlight the message in question
• Select the Forward button.
• Enter the email address of the person to whom you are sending the message in the To: field.
• Send the message.
• Once you have successfully forwarded the message with full headers be sure to switch back to 'normal headers by selecting View > Headers > Normal.                                                                          

[#6]

Many thanks, 22 over7.  I have now forwarded the suspicious email to the abuse and spamtraining addresses mentioned elsewhere but not as attachments as requested.  Any help out there as to how to do that please?

EDIT: Sorry, have just been lazy here.  I now see how to do this in Thunderbird: Message > Forward as > Attachment.  DOH!

I notice that some of the letter combinations in the "Reply to" address spell "...buy...sex..."

And can someone in PN please verify this email as theirs or is it phishing?

Regards

EmpireCad2  (formerly just EmpireCad)

[#7]

Hi @EmpireCad2,

Just to confirm, the email included in the original post does indeed appear to be from us.

[#8]

---

@EmpireCad2 wrote:

Thanks for your comments Chris and Alex.  I have just opened the email normally and it does indeed look genuine.  @HOWEVER, PlusNet always communicate with me via my Postmaster @ etc email address and always address me by name so I am still suspicious.  Can someone from PN staff please advise if this is from PN or not?

As regards how to send the whole email as an attachment with full header, I am on a PC using Mozilla Thunderbird.

Regards

EmpireCad

---

I am suspicious for like reasons. Both the "comm" in the from and the fact that other phishers have been addressed to my wife's inbox is very disturbing, as also is the fact that all passwords were changed after the first suspicious mail.

[#9]

@TheMightyAJ  I would hope you or your colleagues can give a believable explanation why some emails from, or purporting to originate from Plusnet are addressed to may wife@username.plus.com, whilst others, like those today about my service change are properly addressed to username@username.

And I have checked my email settings Seems to me, in my innocence, something PN end is boxed and coxed

[#10]

Hey all.

Firstly Chris is staff just like me and Alex, it looks like there seems to be some confusion above.

I would hope you or your colleagues can give a believable explanation why some emails from, or purporting to originate from Plusnet are addressed to may wife@username.plus.com, whilst others, like those today about my service change are properly addressed to username@username.

This is likely just because the emails we send directly from your account come from a different mailbox and are sent via a different way than the comm.plus.net mailbox.

[#11]

Thanks Gandalf,

I thought it was a legitimate e-mail from yourselves, sorry for the criticism.

Also I understand businesses want to communicate with their customers, but in this day and age you can never be too careful.

[#12]

No problems. Yeah I appreciate the caution.

Let us know if you have any further queries.

[#13]

@Gandalf,

I think an important point (question) is being missed here.

Why is Plusnet emailing secondary email addresses - regardless of where they are being sent from?

The only legitimate email addresses are the default address and any additional notification email address added by the user.

@Luzern wife@ has not been added as an additional email address ... has it?

[#14]

Top marks to PR.  They must have put some effort into making it look like a phising mail

[#15]

---

@Townman wrote:
@Gandalf,

I think an important point (question) is being missed here.

Why is Plusnet emailing secondary email addresses - regardless of where they are being sent from?

The only legitimate email addresses are the default address and any additional notification email address added by the user.

@Luzern wife@ has not been added as an additional email address ... has it?

---

 @TownmanSorry for no reply, as have suffered both telephony and internet (router) troubles. But answer is 'no'.