Comcast/Norton Scam

Scams
1

Was planning on doing this by myself, but found a lack of time to investigate a scam this sophisticated.

So, I’m calling on the help of the community.

Here’s the rundown:

It was in the news recently that Comcast dropped Norton as a partner, scammers took advantage of this and built a scam pretending to be Norton for the victim to renew their Life Lock.
Email gets sent to a victim with a number to call, they then get passed onto another phone number. Remote access is given, form is complete and victim logs into bank.

Here is the information so far:

**Numbers:**
`(321) 343 5179` - The one in the email
`(228) 231 8704` - The main one
`(667) 842-0531` - Was called back on this one after hung up without notice

**Websites:**
`bbbrefundsecure.weebly.com` - This is basically their hub, got all the links the scammer needs for the scam
`https://maztzduswijjjvzzphf6vg-on.drv.tw/NORTON%E2%84%A2/NORTON%E2%84%A2%20SERVERS.html` - Where they keep their downloads for the victim

**Aliases**
So far talked to 3 people: Sam, Steven, Jeff. Off a guess, I'd say the call center is around 10 agents at one time, heard several phone calls going on while it was 3am their time

**Email:**
`[email protected]` - Where the main email came from
Seems they only use frontier.com for the email address

That's all the info we have on them for now, would appreciate help in this. I'll be adding to this as well.
Thanks 👍

2

Got a “You have reached the mailbox of this number” on the email one

On the main one, it gets you a “The TextNow subscribier you are trying to call is currently unavailable.”

3

It’s quite shocking that scammers are this watchful. That looks rather like a fake BBB scam than some norton/comcast scam

4

This may have something to do with it,

![image image2png.png](https://tlscommunity.com/assets/2021-01-16/17:51:300-image2png.png)
![image image1png.png](https://tlscommunity.com/assets/2021-01-16/17:52:230-image1png.png)

A registered house in Florida that has the same number as the one in the email.

5

@Andromeda#174301 Yeah, smart ones. The main part of it is a refund scam where you can either pay cancellation fee for Norton Life Lock, or renew it

6

@Eth0_Sec#174304 so these people could be money mules, but what do the 86, 63 and 55 stand for?

7

@Eth0_Sec#174298 I haven’t been able to get an answer on any number, just vm. Saturday, 1:00 pm est

8

@Andromeda#174305 Good point, here’s the URL if you want to take a look at it 4115 Arrow Ridge Pl, Kissimmee, FL 34741 owner and property records

9

@Eth0_Sec#174340 @Andromeda The number refers to approximate age

10

@Eth0_Sec#174347 wow an 86 year old money mule then ROFL

11

The mules seem to live in posh apartments and perhaps revel in the miseries of the victims
12

@Andromeda#174413 Was thinking that, but they’re listed as previous residents. Need to find where they’ve moved to