Spampository – “IRS Notice” – Poway Dentistry

Spampository – Entry – 000003

E-mail Details

Body:

Analysis

Spam Warning Signs

• Phishing scam.
• Not personally addressed.
• The URLs being linked to in the e-mail do not match the domain name URL from which the e-mail was sent.
• The URLs being linked to do not link to the official Internal Revenue Service / IRS website.
• URL deception is taking place – URL in e-mail is not the URL that it links to.
• An e-mail address unrelated to the Internal Revenue Service / IRS website is used to send the e-mail.
• Requests such as these are not typically received from government agencies – in fact, many would prohibit their employees sending such e-mails.
• Internal Revenue Service / IRS is specific to the United States, and therefore doesn’t apply in the UK – and this was sent to a UK company.

Conclusion

We’ve got a seemingly official e-mail here purportedly from the Internal Revenue Service / IRS – the department that, well, deals with internal revenue in the US ;).  Similar to Her Majesty’s Revenue and Customs (HMRC) in the UK.

And all they want to do is simply ‘confirm a few details’.  Alarm bells set off at this moment.  Government agencies and companies never, in our experience, genuinely request you to confirm your details via e-mail….. ever.

Equally, there are many other signs that this is a sure fire spam / phishing e-mail.  Firstly, the IRS do not use ‘powaydentistry’ to send their e-mails.  We can say this with 100% confidence.  Times are tough, but not that tough that dentists have to start sending out e-mails on behalf of the government!  It’s likely that this from address is spoofed.

Next, they include an official looking IRS link – which actually looks like it will go through to the IRS website.  This is done for credibility.  In actual fact, the link itself will take you through to a completely unrelated domain – however, the page probably shows a copy of an IRS style page in an effort to continue the deception and get you to part with your personal details.  In actual fact, the link text (i.e. the text highlighted in blue – the link description) shows an official looking link, but the link itself (where you will actually end up going to) leads to a very unofficial website.

There’s also the usual things about it not being personalised in any way.  Apart from including your e-mail address – again this is to try and convince you that they already know about you and want you to believe that this is because they are from the IRS.  Of course, they’re not – they know your e-mail address otherwise you wouldn’t have received the e-mail.  They’ve likely harvested it from a website, forum, blog, registration form etc elsewhere on the Internet.

There were 4 links in the original e-mail (all removed for your safety of course!) which linked to four separate, unrelated and unofficial websites – again, another warning sign.

And the biggest warning sign for us was…… we’re a UK based company.  The Inland Revenue Service (IRS) would have no interest in us and wouldn’t be contacting us for information as they’re solely based in the USA.

They try to include an official looking footer (with what is likely the real IRS address), but again, it is just another vein attempt to trick you into believing they have some credibility.

If you’re ever in doubt, don’t do it!