Just when is PN going to get it's act together??

Despite leaving for cheaper climes I am attempting to use my PN email
address to keep track of those who couldn't be bothered to read my
email about a change of address or even (which is starting to look far
more likely) didn't receive it.

Anyway cutting to the chase, there has only been 3 active email
addresses on my PN account & yet PN in their wisdom are allowing
spammers/malware posters access via my PN domain, without my authority
to propergate various amounts of crud...

Latest one I've been informed off...

User is (E-Mail Removed) (never heard of such a being but
yes it is my old PN domain)
& was accepted by ptb-mxcore04.plus.net [212.159.14.218] which is
PN......

Is this yet another problem caused by the robbing 'Peter to pay Paul'
attitude which they have so clearly had causing myself & quite a few
others to leave or have they got a largish security problem which they
have no wish to fix, as it would cost money.

For myself with the amount of similar rubbish such as above being
received on that domain I think it very likely that I won't even
bother doing the minimum to keep the account afloat as it's just not
worth having to go thru 90 -100 rejected email notifications just for
the 1 or 2 emails which may be useful.

kraftee wrote:
> Despite leaving for cheaper climes I am attempting to use my PN email
> address to keep track of those who couldn't be bothered to read my
> email about a change of address or even (which is starting to look far
> more likely) didn't receive it.
>
> Anyway cutting to the chase, there has only been 3 active email
> addresses on my PN account & yet PN in their wisdom are allowing
> spammers/malware posters access via my PN domain, without my authority
> to propergate various amounts of crud...
>
> Latest one I've been informed off...
>
> User is (E-Mail Removed) (never heard of such a being but
> yes it is my old PN domain)
> & was accepted by ptb-mxcore04.plus.net [212.159.14.218] which is
> PN......
>
> Is this yet another problem caused by the robbing 'Peter to pay Paul'
> attitude which they have so clearly had causing myself & quite a few
> others to leave or have they got a largish security problem which they
> have no wish to fix, as it would cost money.

Is it PN or just spammers trying every possible combination?

Feeeuk have a similar "domain" system for e-mail. I get the sort of
spam you have indicated at both my PN address and my Freeuk address.
Must admit though that there is rather less coming via Freeuk than via
PN. Having said that I do have a Bigfoot account, which forwards to PN.
It could be that much of my PN spam is actually through Bigfoot.

I get very little spam through my other e-mail accounts, even the one
reserved for Usenet, and non at all through my BT account.

--
Old Codger
e-mail use reply to field

What matters in politics is not what happens, but what you can make
people believe has happened. [Janet Daley 27/8/2003]

"kraftee" <kraftee@b&e-cottee.me.uk> wrote in message
news:eoj14t$9fb$(E-Mail Removed)...
> Despite leaving for cheaper climes I am attempting to use my PN email
> address to keep track of those who couldn't be bothered to read my email
> about a change of address or even (which is starting to look far more
> likely) didn't receive it.
>
> Anyway cutting to the chase, there has only been 3 active email addresses
> on my PN account & yet PN in their wisdom are allowing spammers/malware
> posters access via my PN domain, without my authority to propergate
> various amounts of crud...
>
> Latest one I've been informed off...
>
> User is (E-Mail Removed) (never heard of such a being but yes
> it is my old PN domain)
> & was accepted by ptb-mxcore04.plus.net [212.159.14.218] which is PN......
>
> Is this yet another problem caused by the robbing 'Peter to pay Paul'
> attitude which they have so clearly had causing myself & quite a few
> others to leave or have they got a largish security problem which they
> have no wish to fix, as it would cost money.
>
> For myself with the amount of similar rubbish such as above being received
> on that domain I think it very likely that I won't even bother doing the
> minimum to keep the account afloat as it's just not worth having to go
> thru 90 -100 rejected email notifications just for the 1 or 2 emails which
> may be useful.

I don't see how this is plusnets fault. Spammers try all sorts of tricks to
deliver their wares and will try any combination of a domain.
I have becky@domain address (my own domain not an isps) and I recently
started to receive Tim@domain and whatever other name they decide to try.

Old Codger wrote:
> kraftee wrote:
>> Despite leaving for cheaper climes I am attempting to use my PN
>> email address to keep track of those who couldn't be bothered to
>> read my email about a change of address or even (which is starting
>> to look far more likely) didn't receive it.
>>
>> Anyway cutting to the chase, there has only been 3 active email
>> addresses on my PN account & yet PN in their wisdom are allowing
>> spammers/malware posters access via my PN domain, without my
>> authority to propergate various amounts of crud...
>>
>> Latest one I've been informed off...
>>
>> User is (E-Mail Removed) (never heard of such a being
>> but yes it is my old PN domain)
>> & was accepted by ptb-mxcore04.plus.net [212.159.14.218] which is
>> PN......
>>
>> Is this yet another problem caused by the robbing 'Peter to pay
>> Paul' attitude which they have so clearly had causing myself &
>> quite a few others to leave or have they got a largish security
>> problem which they have no wish to fix, as it would cost money.
>
> Is it PN or just spammers trying every possible combination?
>
> Feeeuk have a similar "domain" system for e-mail. I get the sort of
> spam you have indicated at both my PN address and my Freeuk address.
> Must admit though that there is rather less coming via Freeuk than
> via PN. Having said that I do have a Bigfoot account, which
> forwards to PN. It could be that much of my PN spam is actually
> through Bigfoot.
> I get very little spam through my other e-mail accounts, even the
> one reserved for Usenet, and non at all through my BT account.

That's the point it is not spam it's email rejections I'm receiving
which, as far as I can assertain, the originals are originating from
PN but not from any authorized accounts. Tonight I received around 75
email rejections to 15 actual spam.

kraftee wrote on Tue, 16 Jan 2007 17:14:15 -0000:

> Despite leaving for cheaper climes I am attempting to use my PN email
> address to keep track of those who couldn't be bothered to read my email
> about a change of address or even (which is starting to look far more
> likely) didn't receive it.
>
> Anyway cutting to the chase, there has only been 3 active email addresses
> on my PN account & yet PN in their wisdom are allowing spammers/malware
> posters access via my PN domain, without my authority to propergate
> various amounts of crud...
>
> Latest one I've been informed off...
>
> User is (E-Mail Removed) (never heard of such a being but yes
> it is my old PN domain)
> & was accepted by ptb-mxcore04.plus.net [212.159.14.218] which is PN......
>
> Is this yet another problem caused by the robbing 'Peter to pay Paul'
> attitude which they have so clearly had causing myself & quite a few
> others to leave or have they got a largish security problem which they
> have no wish to fix, as it would cost money.
>
> For myself with the amount of similar rubbish such as above being received
> on that domain I think it very likely that I won't even bother doing the
> minimum to keep the account afloat as it's just not worth having to go
> thru 90 -100 rejected email notifications just for the 1 or 2 emails which
> may be useful.

Can you post the full headers? The snippet you posted is useless to see what
is happening.

Anyway, it's likely there's nothing stopping anyone in PN from sending mail
out as being from an address in your "domain", as their SMTP servers don't
check the from addresses (I use the PN servers to send from one of my
domains hosted at 123-reg simply because PN are my ISP at the moment). If it
really has originated inside the PN network, fire off an email to PN with
the headers and pointing out it's a spammer, if you're lucky they might not
just dump it in the trash box.

I'm off to Sky as soon as my MAC arrives - I can't see the point in paying
PN £20.50 a month when I can get more monthly throughput on the same
connection from Sky for £5 (still on a BT line, exchange is scheduled for
Easynet LLU Q1 07 so should be here soon, and I have my web space and most
of my email hosted elsewhere anyway). I've been on Easynet at work years and
have been very impressed with the service and line quality, hopefully I
won't need to ring Sky support and the line will be fine. To be fair I've
had very few problems with PN, I get a 5.5Mbps connection that's stable,
although it did take 45 days, and some prodding via the support system,
after switching to MaxDSL for PN to "adjust my account" so that it knew I
was no longer on 2Mbps Premier and then my throughput speed jumped.

Dan

"kraftee" <kraftee@b&e-cottee.me.uk> wrote in message
news:eoj32e$cut$(E-Mail Removed)...
>
>
> Old Codger wrote:
>> kraftee wrote:
>>> Despite leaving for cheaper climes I am attempting to use my PN
>>> email address to keep track of those who couldn't be bothered to
>>> read my email about a change of address or even (which is starting
>>> to look far more likely) didn't receive it.
>>>
>>> Anyway cutting to the chase, there has only been 3 active email
>>> addresses on my PN account & yet PN in their wisdom are allowing
>>> spammers/malware posters access via my PN domain, without my
>>> authority to propergate various amounts of crud...
>>>
>>> Latest one I've been informed off...
>>>
>>> User is (E-Mail Removed) (never heard of such a being
>>> but yes it is my old PN domain)
>>> & was accepted by ptb-mxcore04.plus.net [212.159.14.218] which is
>>> PN......
>>>
>>> Is this yet another problem caused by the robbing 'Peter to pay
>>> Paul' attitude which they have so clearly had causing myself &
>>> quite a few others to leave or have they got a largish security
>>> problem which they have no wish to fix, as it would cost money.
>>
>> Is it PN or just spammers trying every possible combination?
>>
>> Feeeuk have a similar "domain" system for e-mail. I get the sort of
>> spam you have indicated at both my PN address and my Freeuk address.
>> Must admit though that there is rather less coming via Freeuk than
>> via PN. Having said that I do have a Bigfoot account, which
>> forwards to PN. It could be that much of my PN spam is actually
>> through Bigfoot.
>> I get very little spam through my other e-mail accounts, even the
>> one reserved for Usenet, and non at all through my BT account.
>
> That's the point it is not spam it's email rejections I'm receiving which,
> as far as I can assertain, the originals are originating from PN but not
> from any authorized accounts. Tonight I received around 75 email
> rejections to 15 actual spam.

Sounds like you've been joe jobbed.

You are getting the backscatter from email being sent by spammers using your
domain as the spoofed sender address.

The spam mails are probably not originating from plusnet at all.
They are originating from *wherever*, with your domain as the faked sender
address.

So you get the backscatter of rejections.

Not a lot you can do, unless you run your own mailserver. In that case,
you may be able to reject some of the backscatter. Otherwise, sit tight and
wait for it to pass.

--
Ron

On Tuesday, in article
<eoj14t$9fb$(E-Mail Removed)>
kraftee@b&e-cottee.me.uk "kraftee" wrote:

> Anyway cutting to the chase, there has only been 3 active email
> addresses on my PN account & yet PN in their wisdom are allowing
> spammers/malware posters access via my PN domain, without my authority
> to propergate various amounts of crud...
>
> Latest one I've been informed off...
>
> User is (E-Mail Removed) (never heard of such a being but
> yes it is my old PN domain)
> & was accepted by ptb-mxcore04.plus.net [212.159.14.218] which is
> PN......
>
> Is this yet another problem caused by the robbing 'Peter to pay Paul'
> attitude which they have so clearly had causing myself & quite a few
> others to leave or have they got a largish security problem which they
> have no wish to fix, as it would cost money.

Spammers have been faking headers for almost as long as there have been
spammers. It might never have been near Plusnet.

Without seeing the full set of headers, deciding what had happened would
be pure guesswork.

And it would need somebody more familiar than I with the patterns of
authentic Plusnet traffic.

But Rule Zero of Spam tracing is that Spammers Lie.

--
David G. Bell -- SF Fan, Filker, and Punslinger.

"I am Number Two," said Penfold. "You are Number Six."

On 16 Jan 2007, "kraftee" <kraftee@b&e-cottee.me.uk> wrote:

>User is (E-Mail Removed) (never heard of such a being
>but yes it is my old PN domain)

Spammers send mail with a pseudo user mail address that can be from
some random list of names, or whatever... you get the junk back as
the (dumb) mail server at the other end has not simply rejected it
but separately sends back a 'fail' message. Incidentally, unless
you took steps to 'hide' your reverse DNS entry at PN, if you ever
had a static IP then websites logging visitors could have looked up
the part 'kraftee.plus.com' and then used that as a target domain
for spoofed mail addresses. I know that users can opt to have their
username replaced with the IP number instead... Something others on
PlusNet might want to do. Those on BB+ are 'hidden' automatically,
as they always have a dynamic IP.

Ron Lowe wrote:
> "kraftee" <kraftee@b&e-cottee.me.uk> wrote in message
> news:eoj32e$cut$(E-Mail Removed)...
>>
>>
>> Old Codger wrote:
>>> kraftee wrote:
>>>> Despite leaving for cheaper climes I am attempting to use my PN
>>>> email address to keep track of those who couldn't be bothered to
>>>> read my email about a change of address or even (which is
>>>> starting to look far more likely) didn't receive it.
>>>>
>>>> Anyway cutting to the chase, there has only been 3 active email
>>>> addresses on my PN account & yet PN in their wisdom are allowing
>>>> spammers/malware posters access via my PN domain, without my
>>>> authority to propergate various amounts of crud...
>>>>
>>>> Latest one I've been informed off...
>>>>
>>>> User is (E-Mail Removed) (never heard of such a being
>>>> but yes it is my old PN domain)
>>>> & was accepted by ptb-mxcore04.plus.net [212.159.14.218] which is
>>>> PN......
>>>>
>>>> Is this yet another problem caused by the robbing 'Peter to pay
>>>> Paul' attitude which they have so clearly had causing myself &
>>>> quite a few others to leave or have they got a largish security
>>>> problem which they have no wish to fix, as it would cost money.
>>>
>>> Is it PN or just spammers trying every possible combination?
>>>
>>> Feeeuk have a similar "domain" system for e-mail. I get the sort
>>> of spam you have indicated at both my PN address and my Freeuk
>>> address. Must admit though that there is rather less coming via
>>> Freeuk than via PN. Having said that I do have a Bigfoot account,
>>> which forwards to PN. It could be that much of my PN spam is
>>> actually through Bigfoot.
>>> I get very little spam through my other e-mail accounts, even the
>>> one reserved for Usenet, and non at all through my BT account.
>>
>> That's the point it is not spam it's email rejections I'm
>> receiving which, as far as I can assertain, the originals are
>> originating from PN but not from any authorized accounts. Tonight
>> I received around 75 email rejections to 15 actual spam.
>
> Sounds like you've been joe jobbed.
>
> You are getting the backscatter from email being sent by spammers
> using your domain as the spoofed sender address.
>
> The spam mails are probably not originating from plusnet at all.
> They are originating from *wherever*, with your domain as the faked
> sender address.
>
> So you get the backscatter of rejections.
>
> Not a lot you can do, unless you run your own mailserver. In that
> case, you may be able to reject some of the backscatter. Otherwise,
> sit tight and wait for it to pass.

That's what I first thought but some (if not the majority) of them are
actually being sent out by plusnets mailserver, so who ever is doing
it is either that proficient that they can effectively hide the actual
path or (far more likely judging by the way PN had started to go
before I left) there is a massive security hole on their mail server

As I pointed out in my first post the actual server sending the mail
on is ptb-mxcore04.plus.net [212.159.14.218]

On Tue, 16 Jan 2007 17:43:04 -0000, "Beck" <beck@none> wrote:

>
>"kraftee" <kraftee@b&e-cottee.me.uk> wrote in message
>news:eoj14t$9fb$(E-Mail Removed)...
>> Despite leaving for cheaper climes I am attempting to use my PN email
>> address to keep track of those who couldn't be bothered to read my email
>> about a change of address or even (which is starting to look far more
>> likely) didn't receive it.
>>
>> Anyway cutting to the chase, there has only been 3 active email addresses
>> on my PN account & yet PN in their wisdom are allowing spammers/malware
>> posters access via my PN domain, without my authority to propergate
>> various amounts of crud...
>>
>> Latest one I've been informed off...
>>
>> User is (E-Mail Removed) (never heard of such a being but yes
>> it is my old PN domain)
>> & was accepted by ptb-mxcore04.plus.net [212.159.14.218] which is PN......
>>
>> Is this yet another problem caused by the robbing 'Peter to pay Paul'
>> attitude which they have so clearly had causing myself & quite a few
>> others to leave or have they got a largish security problem which they
>> have no wish to fix, as it would cost money.
>>
>> For myself with the amount of similar rubbish such as above being received
>> on that domain I think it very likely that I won't even bother doing the
>> minimum to keep the account afloat as it's just not worth having to go
>> thru 90 -100 rejected email notifications just for the 1 or 2 emails which
>> may be useful.
>
>I don't see how this is plusnets fault. Spammers try all sorts of tricks to
>deliver their wares and will try any combination of a domain.
>I have becky@domain address (my own domain not an isps) and I recently
>started to receive Tim@domain and whatever other name they decide to try.

But it's VERY strange that this has happened to a shit load of Plusnet
users of recent, my dial-up account included. I wouldn't be surprised
if Plusnet had sold a list of email addresses.