Phishing for a Tax Refund

What's wrong with this picture?

If you answered "why would the IRS use a web server in Korea to ask for information about my tax refund" you are a winner!

This is a phishing site preying on people who do not know that all you need to do to get your tax rebate is to file a tax return this year. Apparently, this is the hot new phishing scam, and the IRS has instructions for how to handle it.

The e-mail came in at 21:07 PDT today. By 21:30 PDT it was not recognized as a phishing site by either Internet Explorer or Firefox. By 21:35 Firefox had it marked. Impressive. By 21:40 IE did not have it marked, which I found interesting.

Published Sun, May 4 2008 9:30 PM by jesper
Filed under:

Comments

# Simon Anderson said on 05 May, 2008 12:56 AM

Hi Jesper,

I like it how they dont send any spam originating from there IP address. I guess when there are so many zombies out there they dont need to.

www.dnsright.com/MXBlacklist.aspx

Love reading your blog.

Cheers

Simon

# jesper said on 05 May, 2008 01:07 AM

Simon, do you mean how they can send the e-mail message without getting their mail server black listed? More than likely they are using a botnet to send this stuff. The message I got originated in an address that is part of a huge netblock allocated to Polish Telecom. I have not done any more digging than that, but I'd be willing to get it is just a bot host that was made to send e-mail. That particular address is currently black listed by only three of the mail server black lists: www.dnsright.com/MXBlacklist.aspx.

BTW, it is now 23:07 PDT, and IE still is not detecting this site as a phishing site.