Scam Email supposedly from PlusNet

[#1]

I thought I would just warn you that if you get an email claiming to be from PlusNet and with the Subject as “Update] Your Services Agreement made clearer”

This is a scam email sent from a Hotmail address and the link in the email would take you to a server in Chile.  Hardly likely that PlusNet would be using such email addresses or web servers.

DO NOT Click on the link in the email.

[#2]

I noticed the email didn't look right and the link did not go to a Plusnet address so was going to post a query here. Thanks for confirming my suspicions. 👍

[#3]

Ok so got this mail today and it look ok until I saw the email address on the top didn't click any links just mark it as spam and reported it. when hovered over the link proceed now I could see that it was not going to Plusnet website.

[#4]

Any idea of the result of clicking the link ?  (Some of us are idiots!)

[#5]

@deanmrd Did the 'from' address not immediately set alarm bells ringing?

[#6]

Obviously not or I wouldn't be asking the question! "Plusnet [Update 5E9]" seemed a little strange but no more than that - in my naivety I probably assumed it was a new feature Plusnet had introduced. I did Google "Update5E9" to see if it had been mentioned at all and there as no result so perhaps I thought nobody had raised a query about it. What I vaguely remember happening was that after clicking the link Firefox displayed a message to the effect that the connection could not be made because a certificate was invalid or out of date or words to that effect. (At 85 my memory is not perfect!) I'd still appreciate any thoughts on whether or not clicking the link would have any ill effects.

[#7]

"@deanmrd Did the 'from' address not immediately set alarm bells ringing?"

Yes.

[#8]

@exsapper I wasn't talking about the message 'title', more the senders name/email address - Plusnet emails come from an '@Plusnet' address, not some random outlook/msn/hotmail one.

[#9]

One lives and learns (And hopefully remembers!)

[#10]

The link in the scam email would take you to a subdirectory on the web server for a Chilean company called Geret which is a Telecommunications Company.  Someone has managed to hack into the server and plant a nasty.  Hence if you follow the link you are highly likely to catch something on your PC.  the link starts with https.  This means that communication to the website is supposedly secure.  To ensure that the website belongs to who it says a certificate is issued by a trusted third party, for example Cloudflare.  Before issuing the certificate you have to prove who you are.  Certificates have to be regularlt renewed.  Firefox and other browsers check that the certificate is valid and if it is not you get the warning you saw.  Hence it is always good pratice to ensure you are using the latest version of the web browser, in the case of Firefox that is 103.0

Hope this answer helps

[#11]

The link and the site may be secure and the owners have been verified but that's no guarantee of safe contents.

[#12]

Superlatively comprehensive reply - thank you. As the Firefox message inferred that the connection could not be made does that mean I did not actually get through to the server and hence "get caught" or could I nonetheless still possibly potentially have a problem?

[#13]

Hi exsapper, it is very unlikely you got through to whatever nasty was lurking in the message from Hazelglidewell@hotmail.co.uk masquerading as Plusnet [Update-2D9]

If you went into the Firefox Certificate Manager and overrode the warnings maybe you would get through to

https://geret.cl/        proyecto/php_lib/ckeditor4.5.10/plugins/uploadcare/icons/

above is the actual hyperlink (with some added spaces) which is hiding behind the 'Proceed now' text

it is possible you would catch something.  Maybe if you set up a virtual windows machine you could actually try it.

BTW similar safeguards exist in Google Chrome and MS Edge browsers.

[#14]

Thanks for the heads up. 

If anyone still has the email, please forward it to abuse@plus.net then delete it straight away. 

We go into more detail here https://www.plus.net/help/legal/service-abuse/