Possible Phishing/Spam Email

Don't know if anyone else has received the following suspicious email so just wanted to share.  I don't know this person and have blocked future emails and deleted the original.

From: Norton Community [mailto:noreply@nortoncommunity.symantec.com]
Sent: Saturday, November 25, 2017 6:35 AM
To: My email address
Subject: New private message at Norton Community.

 

Hi (My User ID)

This is an automatic reminder from the site Norton Community. You have received a new private message from LauraRalph.

To read your message, follow this link:
(Message Link)

If you don't want to receive these emails again, change your preferences here:

(Message Link)

The email basically said he/she was a sergeant in the U.S. and provided a Gmail email address and said to email back and I would be told why I had been contacted.  I traced the IP Address and this was the info returned.

Details for 167.89.84.104

IP:167.89.84.104

Decimal:2807649384

Hostname:o1678984x104.outbound-mail.sendgrid.net

ASN:11377

ISP:SendGrid

Organization:SendGrid

Services:Likely mail server

Type:Corporate

Assignment:Static IP

Blacklist:

Continent:North America

Country:United States 

State/Region:Colorado

City:Denver

Latitude:39.7525  (39° 45′ 9.00″ N)

Longitude:-104.9995  (104° 59′ 58.20″ W)

Postal Code:80202

 

That member hacked one of the best famous security software websites has surely been ingenious.

There is no hacking here. Just a new user signing up for the forum and sending a bunch of PMs until they get caught. The Admins are working on this.

 

 

And, it continues...  Looks like i have been upgraded to "dear" (laughs) ;-)

Mohan_G:

Hi folks, 

Thanks for reporting this on time. We are investigating on how this mass spamming happened via PM. 

We've banned the LauraRalph account. 

We will also look into the above mentioned suggestions. Thanks

Sorry for the inconvenience caused.

That member hacked one of the best famous security software websites has surely been ingenious. But, his ingenuity has been for the bad. May God darken his/her mind and close his/her heart.

Hello ,

I have received a new private message which come from now Ralph2 ...

I think that this member it's a boot and which targets random members ...

@SoulAsylum     

If you want block a domain mail for Google , you must block @gmail.com and @googlemail.com , it's the same smtp ...

Even with Yandex ! But here it's a crazy system . If you own a mail adresse with this smtp "@yandex.com"  all smtp here responding in the same mail :

"@yandex.ru"
"@yandex.ua"
"@yandex.kz"
"@yandex.by"
"@yandex.uz"
"@yandex.tj"
"@yandex.az"
"@yandex.lv"
"@yandex.ee"
"@yandex.lt"
"@yandex.fr"
"@yandex.tm"
"@yandex.md"
"@yandex.com.tr"
"@ya.ru"

It's a good new when you want block a complet provider .

 

G-mail is notorious for scammer and hacks. Personally I have had the gmail domain in its entirety completely banned on my gaming forums since day one. Never have an issue with spammers getting in and doing this. Just a thought out to those who can make the changes. I ALSO know there are legit gmail accounts out there however, Google, should be notified as others has brought to light. Although time intensive for the Admins all new accounts should be screened before approval. Other thoughts are this person obviously has to have a Norton account of some sort to be able to create an account here and log in. Worth investigation and shutting that down as well.

Cheers

Yes, lots of Laura Ralph in search.  What is different this time, it is scamming inside a big company that sells security products.

dfkettle:

@ imacri Same email address? Like I said before, someone from Norton should alert Google about this abuse.

Hi dfkettle:

Yes, same e-mail address, identical in content to what MyName13 showed <here> but with the subject line "Hi dear".  I believe the first two PMs I received (now deleted) were much longer messages.

If you google "Sgt Laura Ralph" you'll see various scams dating back years being reported for this "persona" with @gmail, @yahoo, @blaze.uu.ru, etc. e-mail addresses.

The e-mail address used in the private messages (PMs) isn't really the issue, though.  The problem is that Norton is allowing this person to register multiple user accounts in this forum (LauraRalph, now Ralph2) and immediately send out masses of private messages to other users before they've made a single post in the public forum.

MyName13:

Yes, the green "autosave" is really always on and you cannot see what you type  - horrible.  It flashes every second.

Please see my post https://community.norton.com/en/comment/7727251#comment-7727251 in your thread.

@ imacri Same email address? Like I said before, someone from Norton should alert Google about this abuse.

Hi Mohan_G:

I just received a new private message from Sgt Laura Ralph urging me to contact them at their gmail address - this time from new account Ralph2 at https://community.norton.com/en/users/ralph2.

Yes, the green "autosave" is really always on and you cannot see what you type  - horrible.  It flashes every second.

I was so excited to see a PM ;-)  Then i was like, what?  Not gonna lie, i really want to respond to that person and pull a James Veitch (laughs)  Now, i know when i send messages through amazon, their system seems to intuitively scrub links...  

On a side note, is anyone else perturbed with the green "autosave" bar that flashes every so often and blocks your text as you type?

Hoping that everyone had a good Thanksgiving,

Sincerely,

H.B.  

Hi folks, 

Thanks for reporting this on time. We are investigating on how this mass spamming happened via PM. 

We've banned the LauraRalph account. 

We will also look into the above mentioned suggestions. Thanks

Sorry for the inconvenience caused.

 

 

Is anyone else getting spam private messages? How do we report them to the site's admins?

Hi there,

I got this (pic attached) personal message on your norton community. And I think it's spam cuz he used gmail. Norton will never send this message. 
Block the user from accessing norton forum. Cuz if I recvd msg then he must have sent this message to mass users.

Thanks

Yogesh

Hello , Good evening ,

Sorry for this break . It's to signal a spam boot on the forum which send private message :

LauraRalph :

I'm Sgt Laura Ralph from USA

Email me right now at

sergeantlauraralph7@gmail.com )

I will tell you in details the reason why i contacted you there ok.

 You can block this boot .

sewing1243

Tony W does check this Forum Feedback board as part of his Forum Admin duties. Plus, like you, I, and others have contacted the forum admins to have them look into this PM spamming.

 

Peterweb,

If you have any input with the developers might I suggest that you suggest to them making it easier to report future miscreants to the admins. I still haven't found a way to do that other than by a forum post like this or a private message (but then I still haven't hound a place where they are listed so I can message them, I found an old message from Tony W so I had his address and sent him a message, but I don't know if he read it yet).

Please - lose the "Auto Saved" popover showing up every 7 seconds!

This issue is being worked on by the forum developers. Stay tuned.