IRS woo hoo

By joining our community you will have the ability to post topics and access other forums reserved for members. Registration is quick, simple and absolutely free. Join our community today by clicking here.

Posted: Mon Aug 25, 2008 9:25 pm

What a dork

Quote:

Received: from imta15.emeryville.ca.mail.comcast.net ([76.96.30.54])
by rwcrmxc12.comcast.net (rwcrmxc12) with ESMTP
id <20080825210447r1200ngvc2e>; Mon, 25 Aug 2008 21:04:47 +0000
X-Originating-IP: [76.96.30.54]
Received: from clark1.cqrinc.com ([76.8.219.230])
by IMTA15.emeryville.ca.mail.comcast.net with comcast
id 6l4n1a00C4yr5380Fl4nsy; Mon, 25 Aug 2008 21:04:47 +0000
X-CAA-SPAM: 120
X-Authority-Analysis: v=1.0 c=0 p=8EU70KbZrKLuIW7h27gA:9
a=7SHBniq68ae98q4+ray87A==:17 a=DyqFNPAwAAAA:8 a=P6p0gysSAAAA:8
Received: from User ([80.32.111.199]) by clark1.cqrinc.com with Microsoft SMTPSVC(6.0.3790.3959);
Mon, 25 Aug 2008 15:09:37 -0600
Reply-To: <[email protected]>
From: "Internal Revenue Service"<[email protected]>
Subject: IRS - Tax Refund
Date: Mon, 25 Aug 2008 23:02:18 +0200
MIME-Version: 1.0
Content-Type: text/html;
charset="Windows-1251"
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2800.1081
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1081
Bcc:
Return-Path: [email protected]
Message-ID: <[email protected]>
X-OriginalArrivalTime: 25 Aug 2008 21:09:37.0437 (UTC) FILETIME=[E1A7ECD0:01C906F6]

After the last annual calculations of your fiscal activity we have determined that
you are eligible to receive a tax refund of $620.50.
Please submit the tax refund request and allow us 3-6 days in order to
process it.

A refund can be delayed for a variety of reasons.
For example submitting invalid records or applying after the deadline.

To access the form for your tax refund, please click here
[url="http://www.tenerifegolf-services.com/guestbook/lib/index.html"]

Note: For security reasons, we will record your ip-address, the date and time.
Deliberate wrong inputs are criminally pursued and indicated.

Regards,
Internal Revenue Service

Posted: Mon Aug 25, 2008 9:48 pm

Oh, now, that's just too good! Laughing

What a lazy, lazy, not to mention stupid lad.

Chuck Norris Joined: 11 Jun 2007 Posts: 1369

Doesn't look like a lad. Looks like a phishing email.

Posted: Mon Aug 25, 2008 11:47 pm

DEADED

dammit undeaded

Posted: Mon Aug 25, 2008 11:51 pm

edited to add (alive at Monday, August 25, 2008 at 23:54:33UTC)

pretty involved just for phishing
the letter lists url http://www.tenerifegolf-services.com/guestbook/lib/index.html which redirects to http://www.schnew.com//secure/online_form/www.irs.gov/0,,id=96596,00.html which imports irs.gov css

images are at http://www.schnew.com//secure/online_form/www.irs.gov/img/ "Index of /secure/online_form/www.irs.gov/img"

^ http://www.schnew.com//secure/online_form/www.irs.gov/img/irslogo.gif

tenerifegolf-services.com probably hacked

Chuck Norris Joined: 11 Jun 2007 Posts: 1369

Reported to and accepted by Netcraft as a phishing URL.

Posted: Tue Aug 26, 2008 12:42 am

FWIW--

The IRS has a reporting address for any sites pretending to be IRS [email protected] Can't say that I have ever checked after reporting one to them, but I imagine they would be pretty quick to shut them down once reported.