The folks over at Snopes have an article up regarding the rash of recent fake renewal emails purporting to be from Norton. These scams were created to look as if it was official correspondence from Norton Internet Security.
(Some Good Advice From The Article):
Investigating the Suspicious Email
In an example email we reviewed, all links in the message pointed to a website hosted on a Brazilian domain. The “unsubscribe” link at the bottom of the message led to the scam as well.
If readers receive a suspicious email that claims to be from Norton, desktop users can safely hover over links (but not click on them) in order to see where they lead. If they don’t go to an official Norton website, such as “norton.com,” do not click the link.
Also, the email address the message came from appeared to begin with “Norton-Support2021@” and end with a long string of random letters. The email address did not end in “@norton.com” or anything similar.
Advice From Norton
The company published a page to help keep Norton users safe from these kinds of renewal email virus scams. For example, it listed several email addresses they used to send official correspondence: norton@nortonlifelock.com, norton@secure.norton.com, ems@norton.com, lifelock@secure.norton.com, and information@mail.nortonstore.hk.
It’s true that Norton may send renewal offers. However, such offers will never arrive with completely lowercase subject lines. Further, there was no indication that Norton notifies customers “your device has been infected with viruses” in renewal email offers.