Windows Firewall Renewal Scam.

I just got this in an email. It’s time to have some fun.

I have also attached headers below omitting my personal address.

The number sometimes rings to a voicemail but they usually call back.

Dear Customer,

This is a email from Windows Firewall regarding auto renewal of your security services of your computer. Due to Covid-19 pandemic we are loosing employees and are unable to work properly and provide security of your computer. We will auto debit your bank account with $499.99 for automatic renewal of your security services within few hours. For cancellation of your subscription you contact our helpline +1(315) 600 8803. If you are unsatisfied with our service we can refund your subscription instantly.

Helpline number: +1(315) 600 8803

Note: This is a automated message. Please do not reply to this email.

Headers:
Reply-To: [email protected]

Arc-Seal: i=1; a=rsa-sha256; t=1587621120; cv=none; d=google.com; s=arc-20160816; b=LGz7ID6t4nrL9X1roIPM4NxabQbUWMi6SPkPV7JLZQwLtsGb8ZNWLnDfFPK8/vod3z JX3h8v0GCLUnoxzvQjVYHQLu/FDXJWPNPoBzu8ELIDTPxSFUHtF72eudYbVBgZ3I0k5j 2H9y0fWCQw/Z9JaJbhIJSEO497NcIpOeyTqYYBVgyjrdNpQ4PHM6/SQcuROIt7xlIndl jy/cyHFedhJP0Sz1hjY7O3v9UAL2VfafZML1dYNzzpyAeATJKeJ9cDP/RuIvuH8A9FhH D6Wk2FYwUUw2KLbyzHgwdMEcbQMW1ghZTtx4yJ95KxinNu6jDwjgnUp/h4PLBaFUiAFn 1Xow==

X-Received: by 2002:a17:902:b592:: with SMTP id a18mr2301637pls.147.1587621120200; Wed, 22 Apr 2020 22:52:00 -0700 (PDT)

Return-Path: [email protected]

Arc-Authentication-Results: i=1; mx.google.com; dkim=pass [email protected] header.s=dkim header.b=WefCiWjq; spf=pass (google.com: domain of [email protected] designates 157.245.177.237 as permitted sender) [email protected]; dmarc=pass (p=REJECT sp=REJECT dis=NONE) header.from=digital24x.com

X-Google-Smtp-Source: APiQypIrI28XCPARTycBplBAMCTCs7y/SwRMJH8Y+LDcFMUkkt06zoDfb80QIwmQJphruc5FRZBO

Mime-Version: 1.0

X-Virus-Scanned: amavisd-new at mail.digital24x.com

Authentication-Results: mx.google.com; dkim=pass [email protected] header.s=dkim header.b=WefCiWjq; spf=pass (google.com: domain of [email protected] designates 157.245.177.237 as permitted sender) [email protected]; dmarc=pass (p=REJECT sp=REJECT dis=NONE) header.from=digital24x.com

Authentication-Results: mail.digital24x.com (amavisd-new); dkim=pass (1024-bit key) reason=“pass (just generated, assumed good)” header.d=digital24x.com

Arc-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=message-id:date:content-transfer-encoding:subject:to:reply-to:from :mime-version:dkim-signature; bh=EvKeQiy9VkDAGw/Nb0N5iRN8P9vVzjGYpfmfN6egkbg=; b=zlDNq97u8aegOPbd+pZRN4MYUr6C1n9IlebMu02nxLnSBAsMbjSI4bzXo1orvqmG5y bR/leMF4qHploC0PUu3UT0nW6Y28gZNf7FohZ+wO64o3+s176dGHGwJ2dGywwtvtHiRv B8OUOuMvKlAkI2dP4uG4tBZLjhWLhOULn/qEPaJK0udBkZLRBo7bFaS1nvmEKYk6/06l OIz5U1ee8fx6G0JGkJOMyAreLrA2LrU7E+qt40/0LI6bM9bOyyGdcUWMMFLmyBMkLoPV qBdG8kaGx16FFZMDu4KFZ9J0fu9m/kRSRNi8ZIgLHB9Kgub2MNeUiBF6fCGRUJ5Fp7BB /vNA==

Dkim-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=digital24x.com; h=message-id:date:x-mailer:content-transfer-encoding :content-type:subject:to:reply-to:from:mime-version; s=dkim; t= 1587621119; x=1590213120; bh=OSWT4b2qWWFGwF4tPQGieRa45CqD1AC1TPw x3V3nl/A=; b=WefCiWjqSIceCBEDZqQ1dfapz+dIKTraSU8KLa0pjvdiu4i+oRt jEI7Ps7ghEnlq7I57/SYrVLqpdeC6L8h7hflHhR5GrzN2gQc/Xu+jlCmp58zOtV1 0DKw0q4weZBN3QnBTLYt/o8XO96jbmDzQ9knmDmMB9MMWsccskDeXxR4=

X-Mailer: Smart_Send_4_1_3

Content-Transfer-Encoding: quoted-printable

46968506968336922228037@DESKTOP-6G4IRSI

Content-Type: text/html; charset=“windows-1252”

Received-Spf: pass (google.com: domain of [email protected] designates 157.245.177.237 as permitted sender) client-ip=157.245.177.237;

Delivered-To: my email

Received: by 2002:a19:5018:0:0:0:0:0 with SMTP id e24csp1498721lfb; Wed, 22 Apr 2020 22:52:00 -0700 (PDT)

Received: from mail.digital24x.com (mail.digital24x.com. [157.245.177.237]) by mx.google.com with ESMTPS id y7si975922pjg.71.2020.04.22.22.51.59 for (version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128); Wed, 22 Apr 2020 22:52:00 -0700 (PDT)

Received: from mail.digital24x.com (mail.digital24x.com [127.0.0.1]) by mail.digital24x.com (Postfix) with ESMTP id 4975zM4DtZz2YXm for ; Thu, 23 Apr 2020 05:51:59 +0000 (UTC)

Received: from mail.digital24x.com ([127.0.0.1]) by mail.digital24x.com (mail.digital24x.com [127.0.0.1]) (amavisd-new, port 10026) with ESMTP id RqkH-b373bl7 for ; Thu, 23 Apr 2020 05:51:59 +0000 (UTC)

Received: from 182.66.186.212 (unknown [182.66.186.212]) by mail.digital24x.com (Postfix) with ESMTPSA id 4975zL20LJz2YXp for ; Thu, 23 Apr 2020 05:51:57 +0000 (UTC)

Wow… even after I called him out as a scammer, he held it together and insisted he was legit… until i told him shame on his mother for crapping him out on GB Road… then he hung up.