Home   Help Search Groups Login Register  
You are not logged in. To get the full experience of these forums, we recommend you log in or register
Plusnet Usergroup » All Users - The Open Forum » Plusnet Network and Technical Issues » Spam being recieved on Private e-mail addy
Pages: 1 ... 10 11 [12] 13 14 ... 20
  Print  
Author Topic: Spam being recieved on Private e-mail addy  (Read 162540 times)
Penny

Posts: 1781


WWW
« Reply #165 on: May 15, 2007, 11:44:08 pm »

Starting around 21:20 I've started seeing a new batch for Adobe photoshop - anyone else seeing this?
yep

Likewise.

Variety of subject lines, but all those looked at have a link to
mnsoftch.com or mnsoftpa.com in the message body.

Regards,

Penny.

Penny Rollo       Force 9 from 17/02/98       PlusNet from 2000 onwards     
Project HappyChild - free maths worksheets, free French-English
worksheets and 12 other languages http://www.happychild.org.uk
personal site www.pennymidasrollo.plus.com
jelv1

Posts: 2130

« Reply #166 on: May 16, 2007, 12:07:43 am »

Re Tam's suggestion of monitoring honeypots to identify IP addresses which should be blacklisted. I have identified 10 email addresses of the format xxx@<username>.plus.com which are being spammed which are no longer used by me. I have just created a new mailbox called honeypot on my account and aliases for all these addresses - if someone from plusnet wants to look in there to check for common factors feel free - I'll be letting the spam build up in there.

I also have some other addresses which I have been sending to the blackhole for a while, but I'm keeping them separate at present.

jelv
br1anstorm

Posts: 5

« Reply #167 on: May 16, 2007, 12:32:43 am »

Re Tam's suggestion of monitoring honeypots to identify IP addresses which should be blacklisted. I have identified 10 email addresses of the format xxx@<username>.plus.com which are being spammed which are no longer used by me. I have just created a new mailbox called honeypot on my account and aliases for all these addresses - if someone from plusnet wants to look in there to check for common factors feel free - I'll be letting the spam build up in there.

I also have some other addresses which I have been sending to the blackhole for a while, but I'm keeping them separate at present.

First post on this forum... I'm one of the many suffering the spam problem, and after spending time looking at and posting on the main PlusNet forum, I came over here in search of wisdom and advice on what we, the customers and victims, could do immediately to protect ourselves. (Now, incidentally, the PlusNet Member centre and forum and the whole portal seems to be closed for maintenance - or has it overloaded and crashed?).

Back to the point.  As a non-expert home-user-with-laptop, I'm looking for expert advice on how to limit the damage to my accounts and system.  Both Tam and Jelv1 seem to have some ideas on know what steps to take to fend off the spam.  Could they or someone give a step-by-step idiot's guide on how to - for example - set up honeypot, create aliases, and/or blackhole addresses.  I don't know what half these terms mean, but given the present dire circs, I'd really like to limit the damage in any way I can.

I had hoped that PlusNet tech people would put out such advice, but requests from me and others on the Members forum seem to have been ignored.  Any sensible advice would be appreciated...

br1anstorm
Moggy

Posts: 2

« Reply #168 on: May 16, 2007, 12:40:37 am »

I realise that we (F9 Lot) are the poor relations in this company but I thought I'd just say we are being targeted as well. Our thread has not been answered for a while and now the site is down for 'essential maintenance'. Does this mean that I will now need to change my e-mail address to something I have not used before and let everyone I know what the new one is? If so, time to move as I'm fed up to the teeth with all the bloody e-mail problems we have been having. I have been with F9 for 10 years through thick and thin, I'm no Techie, just an honest Joe who wants a reliable service. Looks like Sky may get a look in.

Moggy.
jelv1

Posts: 2130

« Reply #169 on: May 16, 2007, 12:44:04 am »

The portal non-availability was planned and announced:

http://usertools.plus.net/status/archive/1179251610.htm

jelv
Moggy

Posts: 2

« Reply #170 on: May 16, 2007, 12:54:53 am »

Jelv1,
Oh, Thanks mate, trouble is I don't monitor the service status, and when I went to look 'No Portal access'.
And for 6 Hours, best go to sleep then.
RogN

Posts: 21

« Reply #171 on: May 16, 2007, 01:06:35 am »

"I had hoped that PlusNet tech people would put out such advice, but requests from me and others on the Members forum seem to have been ignored.  Any sensible advice would be appreciated..."

Try this
http://bbs.adslguide.org.uk/showthreaded.php?Cat=&Board=plusnet&Number=3001934&page=0&view=expanded&sb=5&o=0&fpart=
WilliamG

Posts: 85

« Reply #172 on: May 16, 2007, 03:31:43 am »

Just to echo what some others have been saying, I've never used webmail yet I'm also receiving this spam - mostly to my postmaster account.

I get a bit lost with some of the technical aspects of this discussion, but if it's any help, I only have two (pop3) mailboxes.

One was set up at the beginning of 2003, and has been receiving the same spam that others have reported.
I've sent many thousands of emails on this particular mailbox to hundreds of different people over the last four years, yet this is the first time it's ever been attacked by spammers.

The second mailbox was set up at the beginning of 2006, and has not [yet] received any spam.
This address has been used to send messages no more than two or three times.

So I wonder - could this spam attack only be affecting mailboxes created after a certain date?
poppy

Posts: 142

« Reply #173 on: May 16, 2007, 07:11:39 am »

With reference to Br1anstorm, I am no expert but I have taken three precautions. Firstly, I did a thorough scan of my computer for viruses and spyware - my security software and patches are up to date and there wasn't a problem. Next,my e-mail address is not essential so I have deleted the mailbox and set up an account with gmail so I now don't need Plusnet/F9 for this service. Thirdly, I have changed the password to my account.  This necessitated changing the router settings too and as I had forgotten how to do it I had to telephone Linksys.  I don't want to change ISP because I have had good service in the past and trust that the staff are working flat out to deal with the problem. 

Force 9
Joined 03 June 2004
LC100

Posts: 283

« Reply #174 on: May 16, 2007, 07:30:13 am »

Hi

Is it not possible for PlusNet to block all emails coming from know open relays?  This has stopped around 95% of all SPAM from this latest security breach in it's tracks for me, the other 5% is dropped immediately as I never use username@username.plus.com so have blocked that, of course I can only do this as I have my own SMTP server.

I think the addresses from the WebMail break-in don't have to be where you have used WebMail, but where someone else may have emailed you from there, perhaps PlusNet could clarify?

The last time I used WebMail was a good couple of years ago and the last time I would have received email from someone else using the system was also a couple of years ago, so why hasn't there been on going maintenance to clear out old data?
jelv1

Posts: 2130

« Reply #175 on: May 16, 2007, 07:58:04 am »

AFAIK it includes addresses which have received emails from webmail as well.

jelv
jelv1

Posts: 2130

« Reply #176 on: May 16, 2007, 08:01:15 am »

Re Tam's suggestion of monitoring honeypots to identify IP addresses which should be blacklisted. I have identified 10 email addresses of the format xxx@<username>.plus.com which are being spammed which are no longer used by me. I have just created a new mailbox called honeypot on my account and aliases for all these addresses - if someone from plusnet wants to look in there to check for common factors feel free - I'll be letting the spam build up in there.

As a result of the spam received overnight that is now 12 email addresses which could be monitored. My honeypot has picked up 23 emails since I set it up around midnight.

jelv
jelv1

Posts: 2130

« Reply #177 on: May 16, 2007, 08:04:49 am »

Is it not possible for PlusNet to block all emails coming from know open relays?  This has stopped around 95% of all SPAM from this latest security breach in it's tracks for me, the other 5% is dropped immediately as I never use username@username.plus.com so have blocked that, of course I can only do this as I have my own SMTP server.

Plusnet do use some blacklists to totally reject emails. However other blacklists are less reliable and should only be used as part of a scoring system - this is why the identified spam is marked and not deleted. For example relay.plus.net is sometimes blacklisted as a result of being reported.

jelv
jelv1

Posts: 2130

« Reply #178 on: May 16, 2007, 08:51:13 am »

We have to receive emails to postmaster. I'm getting a number of spams on this now. Could something be put in place to block emails to postmaster@... from external to Plusnet?

jelv
Oldjim

Posts: 1016

« Reply #179 on: May 16, 2007, 09:21:13 am »

Now that is a really good idea.
Perhaps the same could be done for username@username
Pages: 1 ... 10 11 [12] 13 14 ... 20
  Print  
 
Jump to: