Spampository – Entry – 000003
E-mail Details
| From: | Internal Revenue Service (IRS) 4A384A058[at]powaydentistry[dot]com |
| Subject: | Internal Revenue Service: Notice for business owners |
| Date Received: | 26/09/2012 |
| Attachment(s): | None |
| Thunderbird: | Detected – Possible Scam. |
| SpamAssassin | Detected. |
Body:
Internal Revenue Service (IRS)
Hello,
Due to the alterations in the taxation policies that have been recently applied, IRS informs that Limited Liability Companies, C-Corporations and S-Corporations have to validate their Employer Identification Number in order to confirm their actual status. You have 14-day period in order to examine all the changes and make necessary amendments. We are sorry to cause inconvenience.
For the details please refer to:
https://www[dot]irs[dot]gov/ClientArea.aspx?u=56EE6248F794
- Email address: ***@dpscomputing.com
Sincerely yours,
Chrystal Curtis
IRS Customer Service representative
| This email was sent to ***@dpscomputing.com by: Internal Revenue Service (IRS) ? Internal Revenue Service ? 1111 Constitution Ave. N.W. ? Washington DC 20535 |
Analysis
| Status: | CONFIRMED SPAM |
| Spam Topic: |
|
| URLs Implicated: |
|
Spam Warning Signs
- Phishing scam.
- Not personally addressed.
- The URLs being linked to in the e-mail do not match the domain name URL from which the e-mail was sent.
- The URLs being linked to do not link to the official Internal Revenue Service / IRS website.
- URL deception is taking place – URL in e-mail is not the URL that it links to.
- An e-mail address unrelated to the Internal Revenue Service / IRS website is used to send the e-mail.
- Requests such as these are not typically received from government agencies – in fact, many would prohibit their employees sending such e-mails.
- Internal Revenue Service / IRS is specific to the United States, and therefore doesn’t apply in the UK – and this was sent to a UK company.
Conclusion
We’ve got a seemingly official e-mail here purportedly from the Internal Revenue Service / IRS – the department that, well, deals with internal revenue in the US ;). Similar to Her Majesty’s Revenue and Customs (HMRC) in the UK.
And all they want to do is simply ‘confirm a few details’. Alarm bells set off at this moment. Government agencies and companies never, in our experience, genuinely request you to confirm your details via e-mail….. ever.
Equally, there are many other signs that this is a sure fire spam / phishing e-mail. Firstly, the IRS do not use ‘powaydentistry’ to send their e-mails. We can say this with 100% confidence. Times are tough, but not that tough that dentists have to start sending out e-mails on behalf of the government! It’s likely that this from address is spoofed.
Next, they include an official looking IRS link – which actually looks like it will go through to the IRS website. This is done for credibility. In actual fact, the link itself will take you through to a completely unrelated domain – however, the page probably shows a copy of an IRS style page in an effort to continue the deception and get you to part with your personal details. In actual fact, the link text (i.e. the text highlighted in blue – the link description) shows an official looking link, but the link itself (where you will actually end up going to) leads to a very unofficial website.
There’s also the usual things about it not being personalised in any way. Apart from including your e-mail address – again this is to try and convince you that they already know about you and want you to believe that this is because they are from the IRS. Of course, they’re not – they know your e-mail address otherwise you wouldn’t have received the e-mail. They’ve likely harvested it from a website, forum, blog, registration form etc elsewhere on the Internet.
There were 4 links in the original e-mail (all removed for your safety of course!) which linked to four separate, unrelated and unofficial websites – again, another warning sign.
And the biggest warning sign for us was…… we’re a UK based company. The Inland Revenue Service (IRS) would have no interest in us and wouldn’t be contacting us for information as they’re solely based in the USA.
They try to include an official looking footer (with what is likely the real IRS address), but again, it is just another vein attempt to trick you into believing they have some credibility.
If you’re ever in doubt, don’t do it!