Phishing

By joining our community you will have the ability to post topics and access other forums reserved for members. Registration is quick, simple and absolutely free. Join our community today by clicking here.

Posted: Wed Jan 21, 2009 6:59 pm

I've just picked this out of my spam, it's the most blatant attempt at phishing I've ever seen.

LINK

Forum blowing URL changed to link - Roy

Posted: Wed Jan 21, 2009 7:04 pm

Er, doesn't that take you to the Google Docs login page? Confused

I know they do their best to collect personal information, but as far as I know, Google is legit. Wink

Posted: Wed Jan 21, 2009 7:18 pm

Maybe meant humourously.

I know as a Brit that sometimes humour does not travel well, or sometimes not at all

Wink

Edit to say noted https.

I think I saw that mentioned before on this forum and therefore secure and trusted?

Posted: Wed Jan 21, 2009 7:27 pm

^^Could be. I'll move it to GC just in case. Very Happy

Edit: Hey, you're right. When I put it here, it's quite funny.

GC must be in England. Laughing

Posted: Wed Jan 21, 2009 7:47 pm

/\/\ But the poster isn't. Wink

Posted: Wed Jan 21, 2009 7:55 pm

Well here's the email, it looks a scam to me. Maybe one of you could do the detective work on it. I ain't that good yet.

Delivered-To: [email protected]
Received: by 10.210.132.7 with SMTP id f7cs189223ebd;
Tue, 20 Jan 2009 10:52:19 -0800 (PST)
Received: by 10.65.20.20 with SMTP id x20mr3481130qbi.63.1232477538232;
Tue, 20 Jan 2009 10:52:18 -0800 (PST)
Return-Path: <[email protected]>
Received: from relay.wow.lk (mxr2.wow.lk [202.124.160.61])
by mx.google.com with ESMTP id p9si13809010qbp.35.2009.01.20.10.52.15;
Tue, 20 Jan 2009 10:52:17 -0800 (PST)
Received-SPF: fail (google.com: domain of [email protected] does not designate 202.124.160.61 as permitted sender) client-ip=202.124.160.61;
Authentication-Results: mx.google.com; spf=hardfail (google.com: domain of [email protected] does not designate 202.124.160.61 as permitted sender) [email protected]
Received: from webmail.wow.lk (ftp.wow.lk [202.124.160.4])
by relay.wow.lk (8.13.8/8.13. Cool

with ESMTP id n0KIqAZ6017676
for <[email protected]>; Wed, 21 Jan 2009 00:22:11 +0530
Received: from 217.20.240.19 (proxying for 10.11.19.35)
(SquirrelMail authenticated user inco)
by webmail.wow.lk with HTTP;
Tue, 20 Jan 2009 18:52:11 -0000 (GMT)
Message-ID: <[email protected]>
Date: Tue, 20 Jan 2009 18:52:11 -0000 (GMT)
Subject: United State of America Tax Withholding
From: "Internal revenue services" <[email protected]>
To: [email protected]
User-Agent: SquirrelMail/1.4.17
MIME-Version: 1.0
Content-Type: multipart/mixed;boundary="----=_20090120185211_92576"
X-Priority: 3 (Normal)
Importance: Normal

------=_20090120185211_92576
Content-Type: text/plain; charset="iso-8859-1"
Content-Transfer-Encoding: 8bit

xxxxxxxxxxxxxxx

Our records indicate that you are a non-resident alien. As a result, you
are exempt from United States of America Tax reporting and withholdings,
on interest paid on your bank account and other financial dealings. To
protect your exemption, from paying tax on your accounts and other
financial benefit held in USA, We are required by law to update our
records to rectify your exemption status.

Therefore, you are to authenticate the following by completing form
W-8BEN, and return to us as soon as possible through the fax number:
+1-206-350-8992

If you are a USA Citizen and resident, this form W-8BEN exempts you,
please indicate �USA Citizen/Resident� on the form and return it to us.
We shall then send you a form W9095.

When completing form W-8BEN, please follow the steps below

1. We need you to provide your permanent address if different
from the current mailing address on your Form W-8BEN. You must indicate,
if a non-USA resident, your country of origin to support your non-resident
status (if your bank account or other financial dealing has a USA address
for mailing purpose).

2. If any joint account holder are now USA residents or
Citizen, or in any way subject to USA tax reporting laws, please check the
box in this section.

3. Please have all account holders, sign and date the form
separately and fax it to above-mentioned number.

Please, complete Form W-8BEN �attached� and return to us within 1 (one)
week from the receipt of this letter in order to enable us update your
records immediately. If your account or any other financial benefits are
not rectified in a timely manner, it will be subject to USA tax reporting
and back up withholding (if back up withholding applies, we are require to
withhold 30% of the interest paid to you).

We appreciate your cooperation in helping us protect your exempt status
and also update our records.

Sincerely.
Director of Information

And there's a load of crap after this that I've cut out because >I think it's too much for one post, if you want that too let me know.
Very Happy

Posted: Wed Jan 21, 2009 8:14 pm

Scam email wrote:

Please, complete Form W-8BEN attached and return to us within 1 (one) week from the receipt of this letter in order to enable us update your records immediately.

Did you open the attachment with Google Docs? If so, that could be why the url you posted leads there.

No doubt it's a phishing email, or they may try to hit you up for that "USA tax reporting and back up witholding" money. I'll be that adds up. Wink

Posted: Wed Jan 21, 2009 8:18 pm

+1-206-350-8992 is a Seattle, WA unlisted landline

Sender is spoofing headers, but at least one satellite and a free email service in Sri Lanka involved (Suntel wOw.lk), with the satellite being the probable source.

No return path other than the spoofed IRS address

As OP said, seems to be phishing by fax (phaxing? Very Happy

)

Not much can be done, IMHO

Posted: Wed Jan 21, 2009 8:29 pm

luckey wrote:

Did you open the attachment with Google Docs? If so, that could be why the url you posted leads there.

Quote tags fixed - Roy

Yes. I opened it with google docs. As old No.7 says though, there's not much point doing anything with it, they would just try any info they get, if they come up with nothing they will drop you, or would they?

Posted: Wed Jan 21, 2009 8:41 pm

Mystery solved. I'll move this to misc scams, since it was a serious inquiry. Very Happy