Internal Revenue Service USA

Kat

Administrator
Staff member
#1
This one could really be evil because people are likely to click that link. And it looks like the scammer (in Romania) is piggybacking on the real IRS domain. And the IRS doesn't talk like this anyway.

From Internal Revenue Service Tue Oct 16 2007
Return-Path: <refunds@irs.gov>
Received: from User ([82.78.190.231]) Romania, City: Arad, ISP: RDS, domain, rdsnet.ro
Reply-to: <no.reply@irs.gov>
From: "Internal Revenue Service" <refunds@irs.gov>
Subject: Please Request your refund.


After the last annual calculations of your fiscal activity we have determined that you are eligible to receive a tax refund of $268.32. Please submit the tax refund request and allow us 3-4 business days in order to process it.

A refund can be delayed for a variety of reasons. For example submitting invalid records or applying after the deadline.

To access the form for your tax refund, please click here

Regards,
Internal Revenue Service

© Copyright 2007, Internal Revenue Service U.S.A. All rights reserved.
 

Quark

Moderator
Staff member
#6
From Internal Revenue Service Wed
Return-Path: <refunds@irs.gov>
Received: from 68.235.51.34, USA, Ohio, Roadrunner Forged header!
Reply-to: <no.reply@irs.gov>
From: "Internal Revenue Service" <refunds@irs.gov>
Subject: Please request your refund !
Date: Wed, 10 Oct 2007


After the last annual calculations of your fiscal activity we have determined that you are eligible to receive a tax refund of $268.32. Please submit the tax refund request and allow us 3-4 business days in order to process it.

A refund can be delayed for a variety of reasons. For example submitting invalid records or applying after the deadline.

To access the form for your tax refund, please click here

Regards,
Internal Revenue Service

© Copyright 2007, Internal Revenue Service U.S.A. All rights reserved.
 
#7
Irs

PLEASE READ I received two or three of these. IF you have not heard of this IT IS A SCAM!! The notice number changes & the amounts. You end up at a fake web site giving up your SSN, birthdate & annual income.
THE IRS WOULD NEVER NOTIFY YOU BY E-MAIL!! If you keep trying to contact them to find out where your refund is they will continue to put you off for different reasons, something you did wrong or something you did not do. YOU NEVER CONTACT THE IRS BY E-MAIL GIVING OUT PERSONAL INFORMATION!!!
----------------------------
From: Internal Revenue Service [service@irs.gov]
Date: 12/28/2007
Subject: Fiscal Activity - TAX REFUND ID A822IRS513

{official IRS decal placed here to throw you off which is copied}

After the last annual calculations of your fiscal activity we have
determined that you are eligible to receive a tax refund of $129.72.
Please submit the tax refund request and allow us 3-9 days in order to
process it.
A refund can be delayed for a variety of reasons.
For example submitting invalid records or applying after the deadline.

To access your tax refund, please click here


Best Regards,
Tax Refund Deparment
Internal Revenue Service
 
Last edited:

Dororo

Administrator
Staff member
#8
From Internal Revenue Service
Return-Path: <service@irs.cu.gov>
Received: from 80.177.4.232, UK, London, Demon Internet
Reply-to: <service@irs.cu.gov>
From: "Internal Revenue Service" <service@irs.cu.gov>
Subject: Tax Notification
Date: Tue, 12 Feb 2008


Internal Revenue Service (IRS)
United States Department of the Treasury

After the last annual calculations of your fiscal activity we have determined that you are eligible to receive a tax refund of $184.80.

Please submit the tax refund request and allow us 6-9 days in order to process it.

A refund can be delayed for a variety of reasons. For example submitting invalid records or applying after the deadline.

To access the form for your tax refund, use the following personalized link:

http 0xCA.0x80.0x1D.u0x2 www irs gov

Regards,
Internal Revenue Service


Document Reference: (0xCA.0x80.0x1D.u0x2).
 

Miyuki

Administratrix
Staff member
#9
From Internal Revenue Service
X-Originating-IP: [65.16.193.170] New Bern. North Carolina, Embarq Corporation
Return-Path: <service-refundtax@irs.n US server, et>
Reply-to: <service-refundtax@irs.net>
From: "Internal Revenue Service" ~service-refundtax@irs.net>
Subject: Tax refund - Online form
Date: Sun, 10 Feb 2008


After the last annual calculations of your fiscal activity we have determined that you are eligible to receive a tax refund of $480.23. Please submit the tax refund request and allow us 3-6 days in order to process it.

A refund can be delayed for a variety of reasons. For example submitting invalid records or applying after the deadline.

To access the form for your tax refund, please click here

Note: For security reasons, we will record your ip-address, the date and time.
Deliberate wrong inputs are criminally pursued and indicated.

Regards,
Internal Revenue Service

Copyright 2008, Internal Revenue Service U.S.A. All rights reserved.
 

Naruto

Administrator
Staff member
#10
Return-Path: <service@irs.kl.gov>
Received: from 80.177.4.232, United Kingdom, Demon Internet
Reply-To: <service@irs.kl.gov>
From: Internal Revenue Service<service@irs.kl.gov>
Subject: Tax Notification
Date: Mon, 25 Feb 2008


Internal Revenue Service (IRS)
United States Department of the Treasury
Date: 01/22/2008

After the last annual calculations of your fiscal activity we have determined that you are eligible to receive a tax refund of $184.80.

Please submit the tax refund request and allow us 6-9 days in order to process it.

A refund can be delayed for a variety of reasons. For example submitting invalid records or applying after the deadline.

To access the frm for your tax refund, use the following personalized link:

http 0xCA.0x27 0x30 0xDD www irs.gov

Regards,
Internal Revenue Service


Document Reference: (0xCA.0x27.0x30.0xDD).
 

Sphinx

Administrator
Staff member
#11
Return-Path: ~refundtax@ref.irs.org>
Received: from [121.223.247.59] Australia, Brisbane, bigpond.net.au
Reply-To: ~no.reply@ref.irs.org>
From: "Internal Revenue Service"~refundtax@ref.irs.org>
Subject: Tax Refund (Message ID JN23482)
Date: Sun, 10 Feb 2008

A Secure Way to Receive Your Tax Refunds

After the last annual calculations of your fiscal activity we have determined that you are eligible to receive a tax refund of $873.20. Please submit the tax refund request and allow us 3-9 days in order to process it.

A refund can be delayed for a variety of reasons. For example submitting invalid records or applying after the deadline.

To access the form for your tax refund, please click here

Note: For security reasons, we will record your ip-address, the date and time.
Deliberate wrong inputs are criminally pursued and indicated.

Regards,
Internal Revenue Service

Copyright 2008, Internal Revenue Service U.S.A. All rights reserved.
 

Nanook

Administrator
Staff member
#12
No wonder America is broke. They're giving tax refunds to Canadians. :rolleyes:

From Internal Revenue Service
Return-Path: <service@irs.gov>
Received: from 58.86.35.102 Taiwan, Yife co. Ltd.
Reply-To: <no-reply@irs.gov>
From: "Internal Revenue Service"<service@irs.gov>
Subject: Fiscal Activity - Tax Refund ( ID: IRS980221 )
Date: Sat, 1 Mar 2008

After the last annual calculations of your fiscal activity we have determined that you are eligible to receive a tax refund of $129.72. Please submit the tax refund request and allow us 3-9 days in order to process it.

A refund can be delayed for a variety of reasons. For example submitting invalid records or applying after the deadline.

To access your tax refund, please click here

Best Regards,
Tax Refund Deparment
Internal Revenue Service
© Copyright 2008, Internal Revenue Service U.S.A. All rights reserved.
TAX REFUND ID: IRS980221
 
U

Unregistered

Guest
#13
It's obvious it's a hoax

Look at the address

http 0xCA.0x27.0x30.0xDD www irs gov

What they have done is created a domain called 0xCA.0x27.0x30 and created a subfolder under that domain called www.irs.gov. They aren't piggy backing by any means. It's easy to send email on behalf of anybody in ASP or PHP using CDONTS or CDOSYS. It's not an elaborate hoax by any means, just one more thing for people to click through - at this point it seems to be mostly AOL accounts.
 
Last edited by a moderator:

Garreg Ddu

Gweinyddwr
Staff member
#14
Techie stuff

0xCA.0x27.0x30.0xDD -- is not a domain name - it is the "hexadecimal" representation of a standard 32 bit (4*8 bit grouped) IP "dot address" and in this case translates to 202.39.48.221 in standard decimal - and that then locates the URL address at http://bbclub.com.tw/ where the scammer has hacked in and created his/her trap. The browser software will recognize the hexadecimal input and automatically send the equivalent of the decimal "dot address" forward to the ISP/Router, which then locates the actual site.
 

Quark

Moderator
Staff member
#15
Internal Revenue Service USA, 2008

New tax year, new thread.

irs.edu?


Return-path: <service@irs.edu>
Received: from 204.174.16.241, Canada, British Columbia, New Westminster, parasun.com
Reply-To: [service@irs.edu]
From: Internal Revenue Service<service@irs.edu>
Subject: Tax Notification Internal Revenue Service (IRS)
Date: Mon, 7 Apr 2008


Tax Notification

Internal Revenue Service (IRS)
United States Department of the Treasury

After the last annual calculations of your fiscal activity we have determined that you are eligible to receive a tax refund of $184.80.

Please submit the tax refund request and allow us 6-9 days in order to process it.

A refund can be delayed for a variety of reasons. For example submitting invalid records or applying after the deadline.

To access the form for your tax refund, click here.

Regards,
Internal Revenue Service

Document Reference: (92054568).


Link went to http nemo pelabuhanperikanan or id/vertikal.html. but that thing is dead.
 

Marie

Administrator
Staff member
#16
Return-Path: ~notify@irs.co.us>
Received: from 68.109.228.84, USA, Rhode Island, Cox Communications
Reply-To: ~notify@irs.co.us>
From: "Internal Revenue Service"~notify@irs.co.us>
Subject: Tax return (Message ID: JN34534362)
Date: Sun, 13 Apr 2008
Return-Path: [notify@irs.co.us]



A Secure Way to Receive Your Tax Refund

After the last annual calculations of your fiscal activity we have determined that you are eligible to receive a tax refund of $620.50. Please submit the tax refund request and allow us 3-9 days in order to process it.

A refund can be delayed for a variety of reasons. For example submitting invalid records or applying after the deadline.

To access the form for your tax refund, please click here

Note: For security reasons, we will record your ip-address, the date and time. Deliberate wrong inputs are criminally pursued and indicated.

Regards,
Internal Revenue Service

Copyright 2008, Internal Revenue Service U.S.A. All rights reserved.
 

Garreg Ddu

Gweinyddwr
Staff member
#18
Site can't be reached.

There seems to be an error on the phishing trap site on the Russian server as it now comes up "could not open the page ******* because the server is not responding." :)
 

Kat

Administrator
Staff member
#19
U.S. I.R.S. tax refund, 2008

Received: from 66.15.145.24, USA, California, Los Angeles, verizon.net
Reply-To: [mailid22457@taxrefund9793.irs.gov]
From: Internal Revenue Service<mailid22457@taxrefund9793.irs.gov>
Subject: Internal Revenue Service Tax Refund
Date: Tue, 3 Jun 2008

Internal Revenue Service (IRS)
United States Department of the Treasury

Dear Taxpayer,

After the last annual calculations of your fiscal activity we have determined that you are eligible to receive a tax refund of $284.80.

Please submit the tax refund request and allow us 6-9 days in order to process it.

A refund can be delayed for a variety of reasons. For example submitting invalid records or applying after the deadline.

To access the form for your tax refund, use the following personalized link:

http 0174.012.0177 0244 www irs gov [It's dead.]

Regards,
Internal Revenue Service

Document Reference: (0174.012.0177.0244).
 

Dororo

Administrator
Staff member
#20
Oh I'm lucky. I live in Japan and I get IRS money back. :)

Internal Revenue Service Tax Refund
From Internal Revenue Service
Return-Path: @taxrefund1154.irs.gov>
Reply-To: [mailid48406@taxrefund1154.irs.gov]
From: [Internal Revenue [Service@taxrefund1154.irs.gov]
Subject: Internal Revenue Service Tax Refund
Date: Tue, 3 Jun 2008


Internal Revenue Service (IRS)
United States Department of the Treasury

Dear Taxpayer,

After the last annual calculations of your fiscal activity we have determined that you are eligible to receive a tax refund of $284.80.

Please submit the tax refund request and allow us 6-9 days in order to process it.

A refund can be delayed for a variety of reasons. For example submitting invalid records or applying after the deadline.

To access the form for your tax refund, use the following personalized link:

http 2081062820 www irs gov

Regards,
Internal Revenue Service


Document Reference: (2081062820).

And the link says:

找不到這個網頁
您所要找的網頁可能已經被移除了,可能是它的名稱已經變更,或暫時無法使用。

請嘗試執行下列動作:

* 如果您是在 [網址] 列鍵入網址,請確認網址的拼字是否正確。
* 開啟 2081062820 首頁,然後查看您想尋找之資訊的連結。
* 按一下上一頁按鈕,試試其他的連結。

HTTP 404 - 找不到檔案
Internet Information Services

技術資訊 (供技術支援人員使用)

* 其他資訊:
Microsoft Support

So it is flagged and dead.
 
Top