Was "***SPAM***" not clear enough?

Jonny_B

Erect Member
Oct 14, 2004
9,162
26
41
Marklar
₥76
I got this email forwarded to me from a coworker today:
Is this a scam??

-----Original Message-----
From: Internal Revenue Service [mailto:[email protected]]
Sent: Tuesday, February 19, 2008 5:45 AM
Subject: ***SPAM*** Get Tax Refund

After the last annual calculations of your account activity we have determined that you are eligible to receive a tax refund of $649.30.
Please submit the tax refund request and allow us 3-6 days in order to process it.

A refund can be delayed for a variety of reasons.
For example submitting invalid records or applying after the deadline.

To access the form for your tax refund, please click here <http://internalrevenueservice.mail15.su/GetTaxRefundNow>


Note: Deliberate wrong inputs will be prosecuted by law.


Regards,
Internal Revenue Service United States Department of the Treasury
I have no hope of spam ever stopping because it is apparently very successful. Let's review

1) The spam filter added ***SPAM*** to the subject
2) Outlook put it in the spam folder
3) The url isn't even masked, and is clearly not to irs.gov
4) They're not even offering a very big refund

...and still people want to click. The link tries to download something. I didn't stick around to see what. The user only asked me if it was a scam after clicking. Fortunately the link didn't work for him.
 
Added to phishtank. If you have an account there, please verify it so it will be added to the tank. Also, Virustotal results here.

Looks to me like some n00b script kiddie who can't get their phishing site operating properly.

Edit2. Yes this is a broken phishing site. Missing the file extension, thus the web server serves it as a download instead of parsing.
Phisher's e-mail address if you want to sign him up for free stuff :shifty: [email protected] and use the subject "Here is my info Master" so he'll open the e-mails. And it redirects to another broken site, possibly a phish.
 
Last edited:
Added to phishtank. If you have an account there, please verify it so it will be added to the tank. Also, Virustotal results here.

Looks to me like some n00b script kiddie who can't get their phishing site operating properly.

Edit2. Yes this is a broken phishing site. Missing the file extension, thus the web server serves it as a download instead of parsing.
Phisher's e-mail address if you want to sign him up for free stuff :shifty: [email protected] and use the subject "Here is my info Master" so he'll open the e-mails.
i registered and voted. never thought of adding it anywhere. nice work.