Got a new IRS phishing scam in my home e-mail today. Besides the usual grammatical errors, who would believe that the U.S. Internal Revenue Service would voluntarily provide a refund? Especially to e-mail addresses, when the IRS collects via physical home address.
Looking at the router droppings, the e-mail originates from a server at the University of Houston, which I believe is hacked. The link (which I've defused in the above quote) points to 18.104.22.168, an address owned by Beyond The Network America, Inc., and sub-leased to IronPath Networks. The specific server addressed is one named "~test", which I also suspect of being hacked.
After the last annual calculations of your fiscal activity we have determined that you are eligible to receive a tax refund of $63.80. Please submit the tax refund request and allow us 6-9 days in order to process it.
A refund can be delayed for a variety of reasons. For example submitting invalid records or applying after the deadline.
To access the form for your tax refund, please click here
Internal Revenue Service
I have informed the IRS. They tend to take a dim view of such shennanigans.
Edited to add: If you get one of these, or any e-mail purportedly from the IRS, forward that e-mail to email@example.com