Tax refund scam

By joining our community you will have the ability to post topics and access other forums reserved for members. Registration is quick, simple and absolutely free. Join our community today by clicking here.

Posted: Wed Feb 15, 2012 11:53 pm

This one is new to me, anyone else seen this before? IP comes from Belarus.

Viewing Full Header - View message
Return-Path: <[email protected]>
X-Spam-Checker-Version: SpamAssassin 3.3.2 (2011-06-06) on mc3.midcoast.com
X-Spam-Flag: YES
X-Spam-Level: ********
X-Spam-Status: Yes, score=8.6 required=5.0 tests=DATE_IN_PAST_24_48,
HTML_IMAGE_ONLY_12,HTML_MESSAGE,RCVD_IN_BRBL_LASTEXT,RCVD_IN_PBL,RDNS_NONE,
SPF_HELO_FAIL shortcircuit=no autolearn=disabled version=3.3.2
X-Spam-Report:
* 3.6 RCVD_IN_PBL RBL: Received via a relay in Spamhaus PBL
* [178.125.206.121 listed in zen.spamhaus.org]
* 1.6 RCVD_IN_BRBL_LASTEXT RBL: RCVD_IN_BRBL_LASTEXT
* [178.125.206.121 listed in bb.barracudacentral.org]
* 0.5 DATE_IN_PAST_24_48 Date: is 24 to 48 hours before Received: date
* 0.0 SPF_HELO_FAIL SPF: HELO does not match SPF record (fail)
* [SPF failed: Please see http://www.openspf.org/Why?s=helo;id=irs.gov;ip=178.125.206.121;r=mc3.midcoast.com]
* 1.6 HTML_IMAGE_ONLY_12 BODY: HTML: images with 800-1200 bytes of words
* 0.0 HTML_MESSAGE BODY: HTML included in message
* 1.3 RDNS_NONE Delivered to internal network by a host with no rDNS
X-Original-To:
Received: from localhost (localhost [127.0.0.1])
by mc3.midcoast.com (Postfix) with ESMTP id AB4FD37C889;
Wed, 15 Feb 2012 14:16:21 -0500 (EST)
X-Virus-Scanned: by amavisd-new at midcoast.com
Received: from mc3.midcoast.com ([127.0.0.1])
by localhost (mc3.midcoast.com [127.0.0.1]) (amavisd-new, port 10024)
with ESMTP id QrGvyOcQr2xH; Wed, 15 Feb 2012 14:16:19 -0500 (EST)
Received: from mx1.midcoast.com (mx1.midcoast.com [69.39.100.26])
by mc3.midcoast.com (Postfix) with ESMTP id EAE3FF494B;
Wed, 15 Feb 2012 14:13:43 -0500 (EST)
Received: from irs.gov (unknown [178.125.206.121])
by mx1.midcoast.com (Postfix) with ESMTP id 847CEE122C;
Wed, 15 Feb 2012 14:13:42 -0500 (EST)
Received: from (192.168.1.92) by irs.gov (178.125.206.121) with Microsoft SMTP Server id 8.0.685.24; Wed, 14 Feb 2012 22:13:41 +0300
Message-ID: <[email protected]>
Date: Wed, 14 Feb 2012 22:13:41 +0300
From: "Houston Crowe" <[email protected]>
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.2.12) Gecko/20101103 Thunderbird/3.1.6
MIME-Version: 1.0
To: <@midcoast.com>
Subject: PJM-> Notification about tax refund
Content-Type: multipart/alternative;
boundary="------------01030400608020407080407"
X-Spam-Prev-Subject: Notification about tax refund

Quote:

After the last annual calculations of your financial activity we have estimated that you have a right to receive a tax refund of $438.
Please submit the tax refund request and give us 3-9 days in order to process it.

A refund can be delayed for many different reasons.
E.g., providing invalid records or not complying with a deadline.

To learn the details of your tax refund please click here.

Kind regards,
Tax Refund Department
Internal Revenue Service

I right clicked the link, only long enough to get the web address which is this: http://tallerneftali.com/wp-admin/main.html

No idea what is there, I didn't want to stay around. So far no viruses on my computer.

Have at it whoever wants it. Also forward to Scamwarners (I can't get my login info)

Posted: Thu Feb 16, 2012 12:48 am

This is all I see on the page:

Quote:

WAIT PLEASE
Redirecting to quickbooks...

And then it didn't redirect. ?

Not quite a Newb Joined: 14 Jul 2005 Posts: 41

Just guessing, but maybe some type of overpayment scam?

Redirect isn't redirecting for me, either - tallerneftali.com itself looks fairly tame and hosted by Godaddy, so lots of luck getting it killed, even if you can find the content.

Baiting Guru Joined: 10 Oct 2003 Posts: 4747

have seen these before. the ones I have seen have been phishing scams.

I had one that even said they where going to credit my credit card, all I needed was

cc number
name as it appears on the card
experation date
and the numbers on back

Posted: Thu Feb 16, 2012 1:39 am

^^I was thinking that might be the case, or needing your bank account details so they can make a 'direct deposit.'

Posted: Thu Feb 16, 2012 2:24 am

http://www.tallerneftali.com/ looks legit - someone's blog, maybe. She has a FB and other internet presence.

I think her site has been hacked or phished by scammers/phishers and they have added content to her site. Doing a little searching I also found this linky too:

http://tallerneftali.com/wp-admin/wpndex.php?gave128.php
Which redirects to one of those work at home shams/scams here:
http://homebusiness-training.net/business-news-all/index.html

I would imagine she doesn't have a clue these redirects are on her site. So nothing to kill, but maybe someone could email her and let her know so she can removed them and change her website credentials.