Threat Level: green Handler on Duty: Didier Stevens

SANS ISC: 'Tis the Season for Tax Return Scams - SANS Internet Storm Center SANS ISC InfoSec Forums

Participate: Learn more about our honeypot network

Sign Up for Free!   Forgot Password?
Log In or Sign Up for Free!
'Tis the Season for Tax Return Scams

It's that time of the year again, tax season.  With every tax season is the latest in tax return phishes.  Below is a sample that started hitting the wires a bit ago, but standard click-and-get-0wned.  (This one pointed to a website that was down by the time I found it).  In this case, the phish also pointed into residential DSL space.  If someone out there can happen to snag the malware this thing tries to get, I copy would be apprciated (I'm assuming they change the link in the email routinely).



Tax Notification
Internal Revenue Service (IRS)

United States Department of the Treasury

Date:  01/28/2008

After the last annual calculations of your fiscal

activity we have determined that you are eligible

to receive a tax refund of $134.80.

Please submit the tax refund request and allow us

6-9 days in order to process it.

A refund can be delayed for a variety of reasons.

For example submitting invalid records or applying

after the deadline.

To access the form for your tax refund, click here (BAD LINK HERE).


Internal Revenue Service

Document Reference: (92054568).

John Bambenek, bambenek /at/ gmail [dot] com



262 Posts
ISC Handler
Jan 28th 2008

Sign Up for Free or Log In to start participating in the conversation!