Emails received spoofing the Norton brand

Norton Security | Norton Internet Security
1

I have received a dozen phishing emails over the last 7 days, all with similat texts, spoofing the Norton360 branding, and making the false statement that "My subscription has ended", and "I am at risk".  These ALL came into my Hotmail account, and ALL of them went into the SPAM folder, so no actual issues have arisen, as they were obvious fake spam emails.

What bothers me, is that firstly, there does not seem to be any easy or good way to report this to Norton, and secondly, inexperienced or non-technical "naive" users, with no "defensive tools" or knowledge of phishing scams might fall prey to these scammers, if their email client is not as good as my Outlook2019 is.

I would have thought that Norton would be a large enough company to want to actively protect their "branding" in the AV space, and have a "security and spoofing" help page to help users report these. I DID see a Norton Partners page recommending "spamcop.net" but this seems woefully inadequate for Outlook users, because the articles FAQ page stops at Outlook2007, and even then states that because Outlook re-arranges the headers, makes it impossible to see who sends them.

Here is that (very unhelpful) link mentioned above:

https://www.nortonlifelockpartner.com/security-center/report-email-spam.html   and here is the Spamcop FAQ part with very outdated info:   https://www.spamcop.net/fom-serve/cache/122.html

In any event, the SENDING email account or server is really only 50% of the problem, the REAL problem is the compromised servers, or sub-domains used in the URL LINKS INSIDE THE EMAIL that cause the real damage, in actually collecting the users credentials and credit card details. It is THOSE sites that need shutting down, but regular users do NOT have the knowledge or time to use "tracert", and "whois" to find who the hosting services belong to, and where the proper "abuse@" reporting emails are (if any).

This is where Norton Syamantec should be taking the lead here, to do more to protect their brand, and provide more direct help to users of their product, as most users (as a single entity) do NOT have the time, power, or resources to do that.

2

Thank You bjm_.  It is hard to believe that I have been involved in this industry for 45 years and never heard of APWG.

3

How to Report Phishing
If you got a phishing email or text message, report it. The information you give can help fight the scammers.

Step 1. If you got a phishing email, forward it to the Anti-Phishing Working Group at reportphishing(@)apwg.org. If you got a phishing text message, forward it to SPAM (7726).

Step 2. Report the phishing attack to the FTC at ftc.gov/complaint.

How to Recognize and Avoid Phishing Scams
https://www.consumer.ftc.gov/articles/how-recognize-and-avoid-phishing-scams

Check if your email address is in a data breach
https://haveibeenpwned.com/

Hacked Email
https://www.consumer.ftc.gov/articles/0376-hacked-email

4

A month after the excellent original post on this topic I am still receiving several email a week spoofing Norton and asking for payments.  The Norton Safety Support Center Webpage indicates that all of these instances should be reported but provides no procedure for doing so.

I just spent over 20 minutes on the Norton Chat talking to live support representatives and none of them seemed to even understand the spoofing issue much less be able to provide a reporting procedure.  The last representative was trying to sell me virus detection software.

The Norton products are becoming less and less valuable and the clear indication they do not want to provide any real service to their customers is becoming very apparent.

5

I suspect that Norton will not do anything proactively (at least not public facing) to help users report this phishing and spoofing the Norton Brand, but hopefully they will have the power (and business sense) to do something behind the scenes to take down persisitent threats to their brand.

You migth as well close this now, unless anyone else has anything important to say.

6

So your best plan of action is to report to the authorities there. That is really all Norton would be able to do anyway.

 

7

@peterweb Thanks for your quick reply and response. Unfortunately the EMAIL Spam section only covers California and Canada.

Fortunately, as I am based in Australia, there seems to be some useful sites here, that can use the 2003 Spam Act, and they DO have a reporting email interface. It is here for reference:

https://www.acma.gov.au/stop-getting-spam

I suspect that if "phishing" fraud scams can be shown to be active, then the AFP (Australian Federal Police), or my state police, can be contacted.

I know what you mean about the "wack-a-mole" thing, they can move on quicklty, BUT in my case, I can see 3 persistently used sub-domains used, over the last 7 to 8 days.

8

Here is a link to a Norton Support article about scam calls/emails.   https://support.norton.com/sp/en/ca/home/current/solutions/v126234363

This is where Norton Syamantec should be taking the lead here, to do more to protect their brand,

Unfortunately, chasing spammers is like playing wack a mole. The email addresses and links in the emails are usually only used for a one or two days and then the spammers move on. Of course Norton wants to protect their brand, but the internet is too easy to stay anonymous for long enough to spread these scams.