Did anyone just get an unexpected email titled "New Plex VPN Service"

Did anyone just get an unexpected email from mysafevpn/myvpnsafe? I don’t remember signing up to their mailing list etc? Can’t help but wonder if this is a form of secondary marketing using Plex’s name in what appears to be an endorsement?

Anyone else get this and get the same uneasy feeling about this email?

Let me be clear, I am not saying this email came from Plex (the company)… it’s because I have no reason to believe that I query the nature of this email. Furthermore, this post is in no way an endorsement, and just so there’s no doubt about that, I’ve removed the links from this email as best I can while still making the nature clear

Plex VPN team sales@removedlink.tld via mail238.suw16.rsgsv.net
11:34 (4 minutes ago)
to me

SUBJECT: Plex reveals new VPN business www.removedlink.tld
Plex has been used as a media platform for a long time now with users mainly accessing content they’ve got saved on a local media > server. However, with the recent change in US privacy bills, UK privacy laws and more, it is now more difficult to fill these media servers with the content that users want to enjoy.

Plex media server has now released a new service called www.removedlink.tld [NOTE: It was the senders company name]. This service will help users stay anonymous on the internet so they can download what they want, view what they want, browse where they want, without anyone looking over their shoulder. Internet access and media access can both now be completely anonymous using the new Plex VPN service which can be purchased at removedlink.tld .

Prices are currently on a discounted rate for today in order to allow users to get a chance to try the product. If you are interested, go to www.removedlink.tld and purchase your subscription today for just $9.99 . The team will help get you aligned with the service and you will be setup within minutes.

Do you have questions about our new service? Well because we wanted to make a big impact on the market, we stepped up our customer service from DAY 1. You can reach us via phone call OR SMS at +1-877-745-1560 . Get in touch with us today and we’ll answer all of your questions!

Plex & MySafeVPN Team
Sales@removedlink.tld
1-877-745-1560
Copyright © 2017 myvpnsafe, All rights reserved.
signup via plex referral page

Our mailing address is:
myvpnsafe
18 chickadee circle
Brampton, On L6Z 3L3
Canada

Add us to your address book

Want to change how you receive these emails?
You can update your preferences or unsubscribe from this list

It looks like more people got it… it seems this post has more discussion than mine, so go there.

This is absolutely not a Plex affiliated service or offering. If anything, it suggests that mysafevpn.com is super sketchy and we would recommend using almost any other VPN service with your Plex Media Server.

Hey everyone. This is not us! We were also taken by surprise as many Plex employees received the same email, myself included. We’re seeing very similar emails going out from the same outfit to former Boxee users as well. We are investigating and reporting them to their service and mail providers, but believe this could be related to the 2015 forums breach.

I was a knucklehead and signed up for 3 months only because it was “Plex”. Fortunately, I am able to get a refund. Talking with Nick from mysafevpn, he did say that Plex doesn’t own mysafevpn. But here’s what he did state about the Plex tie-in.

@tiefel said:
I was a knucklehead and signed up for 3 months only because it was “Plex”. Fortunately, I am able to get a refund. Talking with Nick from mysafevpn, he did say that Plex doesn’t own mysafevpn. But here’s what he did state about the Plex tie-in.

@tiefel, glad to hear you are working out a refund. I can assure you this is untrue. I would not trust anything they say, as we got the same line, but they said that Boxee developers had build their product. The former Boxee user base was also targeted in this “campaign.”

Here’s what they’re sending to Boxee users.. look familiar?

I just called and got the same prepared speech they’ve been giving other users about how Plex devs work on their platform. So I decided to quiz them and ask if they knew a certain dev… oh I don’t know, me (who is not even a dev) and they confirmed my name (the only guy at Plex with my first name). So it is total BS.

Hey Guys, received the very same email as ‘hpka’ directed at Plex users. Link leads to a phishing well (pun intended) and malware infected site.


The million dollar question is how did they obtain our email addresses?
Have Plex servers been hacked?

@UberFlyGuy said:
The million dollar question is how did they obtain our email addresses?
Have Plex servers been hacked?

Pretty good evidence suggests this stems from the 2015 forums breach. At the time, we suggested all Plex users change their passwords.

Got the email as well

I as well got the email.

I received the email as well. The odd thing is that it came through my office 365 email account. I have never had that registered with the forums. The only association with my plex account is that I created a plex user to use as a “testing locked out account” before setting up friends and family with accounts. I can confirm that my mother also received this email.

Is there an investigation going on ? I hope ? I would like to be notified as to the outcome.

Also strange, I did not click any links, but if they did link to malware, the fact that office 365 let it in at all is a bit odd.

@nhfilz said:
I received the email as well. The odd thing is that it came through my office 365 email account. I have never had that registered with the forums. The only association with my plex account is that I created a plex user to use as a “testing locked out account” before setting up friends and family with accounts. I can confirm that my mother also received this email.

Is there an investigation going on ? I hope ? I would like to be notified as to the outcome.

Also strange, I did not click any links, but if they did link to malware, the fact that office 365 let it in at all is a bit odd.

Anyone who had a Plex account at the time of the 2015 forums breach also had a “forums” account as they were connected, even if the forum was never used. At the time, our forum vendor handled the credentials and that’s where the breach happened. Since then we have moved to a new forum vendor who does not handle Plex credentials. The VPN scammers are using an email list they likely purchased that dates back to that forums breach. We have investigated the VPM email and reported them, as have others (they were going after Boxee users, too).

Reported headers to mailchimp and received this response:

Blake (MailChimp)
Apr 6, 1:29 PM EDT

Hi there,
Thank you for reporting this to the MailChimp Abuse Desk.

The information you provided has allowed us to locate the account in question, and we are currently investigating.

If you have any additional questions, please let us know.

Thank You,
Blake

From what i could see from my headers they didn’t hide it very well so hopefully they will block it at its source, but as with all things they may just move servers and repeat but hey you can only try lol.

Just saw my spam, I **think ** it came from the breach. I only say that because I have setup several accounts with random@mydomain and only got one email from the ‘forum’

I got one (at least), but had to go looking for it because Gmail put it in my Spam Folder. I guess it met some criteria and got pre-whacked. I like Gmail.