IRS "underreported income" scam

Phishing operations, including perpetrators, how to report them and get them shut down.

IRS "underreported income" scam

Postby MrBill » Fri Oct 09, 2009 10:48 am

The IRS scam is a significant portion of my mail these days - sometimes a dozen messages overnight. So far I haven't been able to catch the link actually functional, so I assume their strategy is to catch a few unsuspecting souls who are watching their incoming mail during the night and who respond immediately - can't be a large number. It's been a long-running phenomenon, though - hard to believe they haven't been caught yet, after several months.
--
Bill Walton
MrBill
New member
 
Posts: 1
Joined: Thu Oct 08, 2009 10:51 am
Location: Boulder Creek, CA, USA

Re: IRS "underreported income" scam

Postby spamislame » Fri Oct 09, 2009 11:48 am

It's Zeus bot.

You can do lots of reading on this:

http://garwarner.blogspot.com/2009/09/i ... inues.html

Previously it was a Michael Jackson story:

http://garwarner.blogspot.com/2009/06/m ... ed-in.html

And before that it was a "Microsoft Update":

http://garwarner.blogspot.com/2009/06/m ... at-is.html

Gar Warner is working with law enforcement to get these domains shut down really, really quickly. Your comment is proof that that's working. On average I receive over 20 of these per day, and out of that usually only one of the messages still has a functioning URL.

SiL
User avatar
spamislame
Site Admin
 
Posts: 5057
Joined: Tue May 09, 2006 9:18 am

Re: IRS "underreported income" scam

Postby meep » Fri Oct 09, 2009 12:27 pm

The Gar Warner blog updates shed a lot of light on this prolific spam. I receive about a dozen of these day. I even saw one with an attachment, but have since deleted it.
User avatar
meep
Spammers' Nightmare
 
Posts: 2777
Joined: Thu Apr 05, 2007 4:10 pm

Re: IRS "underreported income" scam

Postby AlphaCentauri » Fri Oct 09, 2009 7:46 pm

I thought I found a live one, because spamcop generated a report. Turns out the doofuses parked the domain instead of suspending it. So they'll have thousands of spamcop reports coming in reporting their parked page.
User avatar
AlphaCentauri
You are kiillllling-a my bizinisss!
 
Posts: 5989
Joined: Thu Mar 01, 2007 3:01 am


Return to Phishers

Who is online

Users browsing this forum: No registered users and 2 guests

cron