IRS Phishing E-Mail

Duncan J Macdonald · May 1, 2006

Got a new IRS phishing scam in my home e-mail today. Besides the usual grammatical errors, who would believe that the U.S. Internal Revenue Service would voluntarily provide a refund? Especially to e-mail addresses, when the IRS collects via physical home address.

After the last annual calculations of your fiscal activity we have determined that you are eligible to receive a tax refund of $63.80. Please submit the tax refund request and allow us 6-9 days in order to process it.

A refund can be delayed for a variety of reasons. For example submitting invalid records or applying after the deadline.

To access the form for your tax refund, please click here

Regards,
Internal Revenue Service

Looking at the router droppings, the e-mail originates from a server at the University of Houston, which I believe is hacked. The link (which I've defused in the above quote) points to 207.226.88.28, an address owned by Beyond The Network America, Inc., and sub-leased to IronPath Networks. The specific server addressed is one named "~test", which I also suspect of being hacked.

I have informed the IRS. They tend to take a dim view of such shennanigans.

Edited to add: If you get one of these, or any e-mail purportedly from the IRS, forward that e-mail to [email protected]

James D. Macdonald · May 1, 2006

For phishing in general send copies to [email protected]

For phishing that mentions ebay, forward it to [email protected]

For phishing that mentions paypay, forward it to [email protected]

MartyKay · May 1, 2006

If I did that James, I'd be spending my whole day forwarding mail to ebay and paypal.

I've been getting a HUGE amount of paypal, ebay and, strangely Chase phishing lately. My poor Gmail account is getting hammered.

James D. Macdonald · May 2, 2006

Forward the chase ones to [email protected]

If you have a real email account, and use a real mail client (IMHO, Gmail sucks rocks), you can get PopFile from Sourceforge (freeware) to sort all the various sheep and goats into their appropriate pens. Then it's an easy task to group forward the lot of 'em.

JulieB · May 2, 2006

I've been getting hammered with Chase spoofs as well. It's doubly interesting for me because a foriegn client pays me though them. Since English is not the primary language at the branch in question some of the subject lines have looked just like spam. I don't think I've lost any message so far (I'm getting paid), but it's a pain. I use a whitelist and a bayesian filter, but their not perfect.

IRS Phishing E-Mail

Duncan J Macdonald

Plotting! Not Plodding!

James D. Macdonald

Your Genial Uncle

MartyKay

Sockpuppet Hunter

James D. Macdonald

Your Genial Uncle

JulieB

I grow my own catnip