IRS: Important information
[Previous Example] [Share This Page] [Back To The Main SHPAMEE Index] [Next Example]
VERY IMPORTANT INFORMATION, READ THIS FIRST: The example and associated information published on this page are subject to the SHPAMEE Terms Of Use. Please familiarise yourself with these terms before viewing or using any information on this page.
Header:
X-Account-Key: account9
X-UIDL: x
X-Mozilla-Status: 0001
X-Mozilla-Status2: 00000000
X-Mozilla-Keys:
Delivered-To: spam@cybertopcops.com
Received: by 10.58.210.200 with SMTP id mw8csp141505vec;
Wed, 26 Sep 2012 13:16:03 -0700 (PDT)
Received: by 10.14.220.8 with SMTP id n8mr3070332eep.19.1348690563135;
Wed, 26 Sep 2012 13:16:03 -0700 (PDT)
Return-Path: <B7B4E625@wihathailand.com>
Received: from ([95.0.149.108])
by mx.google.com with ESMTP id y1si3799363eep.6.2012.09.26.13.16.01;
Wed, 26 Sep 2012 13:16:02 -0700 (PDT)
Received-SPF: neutral (google.com: 95.0.149.108 is neither permitted nor denied by best guess record for domain of
B7B4E625@wihathailand.com) client-ip=95.0.149.108;
Authentication-Results: mx.google.com; spf=neutral (google.com: 95.0.149.108 is neither permitted nor denied by best
guess record for domain of B7B4E625@wihathailand.com) smtp.mail=B7B4E625@wihathailand.com
Date: Wed, 26 Sep 2012 23:16:00 +0300
From: "Internal Revenue Service (IRS)" <B7B4E625@wihathailand.com>
Subject: IRS: Important information
Mime-Version: 1.0
Content-Type: text/html; chars="ISO-8859-1"
Content-Transfer-Encoding: 7bit
X-Template: irs_alert
X-Accountcode: USIRS
Message-ID: <x@PC-356F7587CDE0>
X-Mailer: GovDelivery HyperMail 1.0 99 irs_alert
Errors-To: F9C507B0@albanypumps.co.uk
To: spam@cybertopcops.com
X-Subscriber: C88CADD78D5D039354D891E18nA=
Body:
Internal Revenue Service (IRS)
Dear business owners,
Due to the system
error the EIN of your company has been
accidently erased from the online database, please
validate your EIN to confirm your actual status
of taxpayer. Certain indulgences will be applied to the next audit
report for your company. IRS is sorry to cause inconvenience.
For detail information, please refer to:
https://www.irs.gov/Login.aspx?u=3408963F997E
- Email address: spam@cybertopcops.com
Sincerely yours,
Willie Hendricks
IRS Customer Service representative
This email was sent to spam@cybertopcops.com by: Internal Revenue Service (IRS) · Internal Revenue Service · 1111 Constitution Ave. N.W. · Washington DC 20535 |
Comments:
Related Cyber Criminal Profiles:
No related profiles found.Similar Spam Examples:
IRS Phishing Scam - For the attention of business ownersPaypal Phishing Scam - Attention! Your PayPal Account Could Be Suspended!
British Airways Phishing Scam - British Airways E-ticket receipts
UPS Phishing Scam - UPS Tracking Number H4122908562
Zales Phishing Scam - Credit Card - Balance Notice
Related Malware Samples:
No related malware samples found.[Previous Example] [Share This Page] [Back To The Main SHPAMEE Index] [Next Example]
Unfortunately for the spammers, we do not report to the US IRS. Secondly, if the IRS ever had to send us an e-mail, we are sure this is the last e-mail address they would use. We will most definitely receive more spam after publishing this example.
Very personal, isn't it? ....
According to irs.gov: "An Employer Identification Number (EIN) is also known as a Federal Tax Identification Number, and is used to identify a business entity."
We are sure the IRS have some backups, so in an event like this, they will simply restore your information from a backup, but in any case, getting erased from the IRS database, is nearly impossible.
But this makes the scam even more ridiculous, how can you confirm your EIN if it has been deleted. Against what will it be validated?
So we guess you will now have a clean slate with the IRS. Many people will be quite glad about this, but sorry to burst your bubble if you haven't filed your tax return for a couple of years, this is a scam, so nothing you read in this e-mail is true.
This is not your typical phishing scam, each link in this e-mail points to a different phishing site and some anti-spam websites have reported that certain links are even malware related.
All the links in the examples we investigated so far pointed to websites that were already taken down or cleaned up, so we haven't been able to confirm whether the main purpose of these examples are phishing or malware related, however it has all the characteristics of a phishing e-mail so we decided to classify it as a phishing scam.
Also refer to the following IRS Phishing scam example. It looks basically the same as this one, but the story is a bit different.