Whaling Scam from the US Tax Court
Please be on the lookout for yet another government agency tax scam making the rounds today; this one not spoofing the IRS, but rather the US Tax Court.
Here is an elided sample that has been received by our Threat Operations Center:
|
UNITED STATES TAX COURT WASHINGTON, DC 20217 |
|
|
Docket No. 622-555. Filed May, 2008. COMMISSIONER OF INTERNAL REVENUE Petitioner. v. EXECUTIVE NAME HERE Respondent. PETITION The Petitioner hereby petitions for a redetermination of forth by the Commissioner of Internal Revenue in his notice of deficiency (AP:FE:BOS:JHK) dated May 4, 2008 Please download a Copy of the Order, Letter, Notice or Other Document Being Appealed This matter is before the Court on respondent.s Motion for Summary Judgment, filed May 10, 2006, and respondent.s Motion for Penalty under I.R.C. Section 6673, also filed May 10, 2006. As motions, without prejudice, and remand this case to respondent.s Office of Appeals. Respectfully submitted, Bennett H. Klein Tax Court Bar No KB0214 400 Second Street, N.W., |
|
The link in above sample goes to a web page hosted at the domain us-tax.org, which was just registered 4 days ago, May 8th. Based on the format of the scam URL in the above message this looks very much like some of the other recent executive targeted scams (like the US District Court scam that I also blogged about) that we have seen lately. It would not surprise me if the same people behind those scams are also originating from the same group of people.
*** UPDATE 5/12/2008 12:40pm MDT *** We are currently seeing these whaling scams hit our systems at the rate of about 150 per hour. Very low volumes in an attempt to fly under the radar as much as possible.
Who registered the us-tax.org domain? They should be in jail before the sun sets tonight.
jr
The other tipoff should be that the US Tax Court (like the other government agency scams that we have frequently written about) never communicate official matters over email. These agencies have no idea what your personal email address is, nor do they want to know. Any legitimate, official communication would be done through the postal service, and if it was important enough they would likely send it registered or certified so that you have to sign for it.
I did not open the email. I assume it's fake. The sender doesn't know that I am nine years old. My only income was about ten dollars from a lemonaid stand last summer.
Several suspicious items flagget it right away to me:
1. The "From:" ID said "United State Tax Court", mising the second "s"
2. The "Reply to:" was a .org addy, NOT .gov
3. The link to click was to a .com URL ....
4. US Government departments (not just IRS) NEVER contact anyone by email on official business. It will be phone or registered letter.
Any advice for what I should be doing now? Destroy the laptop? De-install the certificate (i have no idea which one it was though)? Hope and pray?
I've done quite a bit of research online: there doesn't seem to be any information on what payload this installs or how to remove it.
This is registered to someone in China.
lu zhixin
zhixin lu luzhixin@yahoo.com
0516-3114698 fax: 0516-3114698
peixianchengguangdajie236hao
peixian ngsu 221600
cn
DNS is: ns1.4everdns.com
Not sure we'll get China to stop this!
