RSS

IRS Phishing Scam

27 Jan

IRS PHISHING ATTACK – ONLINE FRAUD

WARNING – IRS does not initiate contact with taxpayers by email to request personal or financial information. 

NOTE: As soon as I received this email I thought it was highly suspicious because not only did I receive it on my “fake bait account” that I use for scam baiting but also because IRS doesn’t send emails and they warn about phishing scams right on their website.I’ve looked up the IP(s) and header information and noticed it was blacklisted on anti fraud websites. Regardless, if you receive a email or any unidentified online user contacts you regarding money and personal/financial information, DO NOT GIVE IT OUT!

THE EMAIL I RECEIVED

animated arrow down2

 

Where’s My Refund opens January 30, 2013.

Due to recent tax law changes, we will open refunding season and start processing individual income tax returns on January 30.
This applies to tax returns filed on paper or electronically.
Our new system calculate your taxes of your fiscal activity from last year and you are eligible to recive a tax refund of $550.
In order to claim your refund you will need to follow the next steps:
* Download the attached form.
* Open it in a new secure window, and follow the instructions on the screen .
You will get your refund within 24 hours after we’ve received your e-filed tax return.
Generally, tax returns and return information are confidential, as required by section 6103 we may disclose your tax information to the Department of Justice for civil and criminal litigation if you are submitting invalid records .
Sincerily ,
Internal Revenue Services .

This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.

HEADER DETAILS:

Internal Revenue Service – Where’s My Refund opens January 30, 2013Wednesday, January 23, 2013 3:51 PM
From IRS Wed Jan 23 07:51:23 2013
X-Apparently-To: deleted@yahoo.com via 98.139.220.247; Wed, 23 Jan 2013 08:51:41 -0800
Return-Path: <notify@irs.gov.e.com>
X-YahooFilteredBulk: 109.202.152.250
Received-SPF: none (domain of irs.gov.e.com does not designate permitted sender hosts)
X-YMailISG: e9gWdlIWLDsVuDoRgzBswxOsNA_ALUCiZ94Yo_GWveDhkE5H XMWm0qDjKA74EzfR2v4U39GjLKyY.tLS2ERBwh8QfEiw6xtMQXuQlwVzLl2d RJ3G2gcy7YXo.kiHr1zYnAy2phBJz_svN95DBa5tLrgMj_bguPLUoWjbWku2 WAqROTpCvFZl9JwRJTYprkGQitCDIECEy4SJb_z54DL7hpJgjQ2pFAzsPIuQ ntA6vloWDZzpvBpH2wh3_xeONQ_83lFE00nr94l652jT_oOgIkiCGpIUBhnB P5tPsFERmMNOP1tIr6NRzxaAEk7nQn7V2u4JV7Ybda6Y6bLNYkJZNLBLI_GG CyMYgwEK0i8V0o0wI4GgnP6uf7UbAfoxYgnZczb4hF9EFmVbF0WQAkU4KP2w OF6HwlRTgczkc1o7S33xg9j47cCXwOVlXdlv5hwqFteGOC4dSmZqQpGciX8C DN834OELrIAaYJtx23oJxUuAt88m.8H3hhZmRbAU24Fa3KsaQoZn23MKMfwW odS9yjtrg.dALJN0VFh2EDOZMMdZG1IZUnCdJ4MQeMPyCndMUyE_Cpa_spZM JeRmb9TtYwNR04S2SOXjuanwLGIVuGu34vuIeHPO56KUuYaWZbtY5M8yymat .jFENS3LsYyRFXCOzLkTPq2cDzaLq76wdP3mfS8tlk488DRSpv04enXKstEg fq9A5vXAKHWgltsPDcWP25RZfcwSbDriislv0nwXBGJUWVLY0StIhyKfRLF1 et9V4Zcgy0wdwJAco7r9l5V6Tw9tfgBzsgE.zQ6C3MgC9NI0X84COjoglzOE F7CDHeeyx3723DnU_UCfp5pOphQKbUG3xJoWaHFEOV7lPjqt8LEE88vGIgoU _9o08aQIgGQUrFN3O_ZMiszwr8_m_jiFoykiwN4WSGBphovmuOArcvkMXJ.L KjZu.3humATM922Yy2TWCEdqHSaYsMsYV2W39z60iB_M0WxJhm2WSOIDHyg3 HQ2JpAIZ7wXvKqM886pUR50I297J32RCrQlr5IPcjbWZgwRllKOmTWhsOypI fjUUAk6cVKzJZlfEN7z8.cFKHlb1DigaMk3pSsADkBR_H2IW..2q9s4KbDsp Gco3D4lqHYqtFP9Uz_YkWUrbEmomVSv8IK5e_WgpHQfvDr9YyN9Et2UICzDr sSfAo3ezKUpFVBBHWDkQ.fyMhOtsLQ5HN1hzllJY7g6Bgc6DB_v4VGT1_.gW 4b_tnAE9_YWWUs.eyUvShqtRkhyPaXyK7FFqsOAC3FpxKHKDgYRwQK64fd7R kPLbN0JKNZCeCPHbVmwe_GQW39dVvaVXug5_Zx3XGsMx1hPW09VmQf7NPoCc AoCQKkw98gK9lSR6bb7fU8jVMtj40VPTVtfp5smsqyGRolgJ3bd0PZRv9itq O7hpNMrthaB2UEWKjni1NJmSMXSSkde0hbkRVphD8FWlp0arA8J1QQgN13.H uA_Mzfe4twcZfdJs3GbKXSdInR_DqmLsTumkAyqZ3LWdCU_Ns9DsJIsto6yu _f0IinFxSMriLOu0kDSTloYWoeQpIA1PBNgwuLggbq_MbM2BLJIcImMRhXL5 p.4zXTWpD2vkWwx4NjgH9QeOKcLVjzNrW8WI6.IxR3e.4VuOI.OqFJ3wdcbO D.CK6vPMS_r6SSXira5mqPN0MyL3XcR5NL_LyIrqHCcYiPK84c3hHzyPlPEh N1KWe8joijPKhNdcXjMTcM.MASnrhuACslmceToaExR54srG93YLv.GTGDiw 2VVTs.9eTBD1_6uc4fgYpta0y3pQ8aUCWRdGwa2jGXASuy8JawOen9OFIkvW iyalHrsiXFG9PkdNtwWBwaO.FhNJlSbr4q7pqQpZSVVuqeKsdD_ojtuUVMma W29GIuqeXO4Zj9lrmyfWswzCe34jeEgVHZoAcURQZBU.ZU9jHn0yRw–
X-Originating-IP: [109.202.152.250]
Authentication-Results: mta1247.mail.ac4.yahoo.com from=irs.gov.e.com; domainkeys=neutral (no sig); from=irs.gov.e.com; dkim=neutral (no sig)
Received: from 127.0.0.1 (EHLO ltidkex01.LumasenseInc.com) (109.202.152.250) by mta1247.mail.ac4.yahoo.com with SMTP; Wed, 23 Jan 2013 08:51:37 -0800
Received: from User ([185.11.132.8] RDNS failed) by ltidkex01.LumasenseInc.com with Microsoft SMTPSVC(6.0.3790.4675); Wed, 23 Jan 2013 16:52:59 +0100
From: “IRS” <notify@irs.gov.e.com>
Subject: Internal Revenue Service – Where<92>s My Refund opens January 30, 2013
Date: Wed, 23 Jan 2013 19:51:23 +0400
Content-Type: multipart/mixed; boundary=”—-=_NextPart_000_0094_01C2A9A6.03D1B7DA”
X-Mailer: Microsoft Outlook Express 6.00.2600.0000
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000
Return-Path: notify@irs.gov.e.com
Message-ID: <LTIDKEX01jnzi95HfqR0000003a@ltidkex01.LumasenseInc.com>
X-OriginalArrivalTime: 23 Jan 2013 15:52:59.0099 (UTC) FILETIME=[B7A89AB0:01CDF981]

notify@irs.gov.e.com IP_USED: 109.202.152.250 RECEIVED_IP: 185.11.132.8

Advertisements
 
 

Tags: , , , , , , , , , , , , ,

One response to “IRS Phishing Scam

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s

 
%d bloggers like this: