Please be sure to read my Spoof/Phishing Scams Home Page

Things I Did, Below

I, personally, receive email in HTML format. Since the email headers could be included, I did not "forward" the email to get the brief headers. The following was received (and looks) like I received it, with the following exceptions:

• Any notes I added in the actual letter are in square brackets ("[" "]"), are bold, red in color, and highlighted. If what I found "behind the links" (email or website) are different than what was displayed, I will include them in this type of note.
• Actual links in the email message have been changed to null (allowing them to still appear as links), have arrows pointing to them ("<=="), have been "named", and appear as one of "my notes" (bold, red in color, and highlighted). They are listed below the email example using the "names".
• All spelling, spacing, line-wrapping, and punctuation errors are the ones that appeared in the original received email. (I may or may not analyze some or all of these.) This email started with the HTML from the email I received. Most of the HTML and the look is original to the email (making this page non-standard HTML 4.01!)

Scam Example

PLEASE NOTE: The IRS website states:

For your own safety, if you receive ANY email that tells you you MUST click a link:

1. Go directly to the site itself and find out
2. If you have an account, log in
3. If what the email says is true, there should be some type of notification at either the main page, or on your account's login page.

BE SURE TO CHECK OUT ANY EMAILS LIKE THIS YOU GET!

[Please note: This whole page will not validate HTML 4.01, though it says it will at the bottom. The reason is because I cut-and-pasted the HTML from the email. -wds]

Received 05/13/2008, 05:55PM

NOTE: This email came with a HIGH PRIORITY. The idea being that you would read it quickly.

Email Headers

[DO NOT send email to any of the following email addresses]

Notes

Links from email, above: (This information is from the SOURCE of the email.)

• Links (behind the words):
  • Behind "Click here" was http:// 211.119.242.70:84 /www. irs.gov/irfofgetstatus.htm - NOTE: It is NOT the IRS website (the site you would go to is 211.119.242.70 on port 84. 211.119.242.70 is from Seoul, Korea, according to GeoBytes IP Address locator (Now WHY would the IRS send ANY email through Korea?)
• Email Header Links:
  • Almost all links in the email headers are revenue @ irs.us.gov, which to me, means the headers were spoofed. Again, the IRS will NOT contact you by email.
  • According to GeoBytes.com's Spam Locator (cut-and-paste full email headers) reports that "We are unable to locate the IP address "98.220.45.90" at this time." - THIS is the address from which the email came. If they are unable to locate it, then it's most definitely spoofed.
• Link Behind Image:
  • The IRS banner/logo is direct from the IRS site: http://www.irs.gov/irs/cda/common/images/irslogo.gif

As you can see, with a little checking BEFORE YOU CLICK A LINK OR REPLY (OR MAKE A PHONE CALL), you can find inconsistencies that can save you from a world of hurt! (and empty bank accounts!)

---

Send comments/questions about this page to Bill Sanders at:

Go to Scams - Spoof/Phishing Scams Home page
Go to Scams - Spoof/Phishing Scams Examples Links

Send email to Bill Sanders ()
with questions or comments about this page or site.

This site, all text and graphics (unless otherwise noted) on it
were designed, developed and published by Bill Sanders of Orange Frog Productions.
It and it's CSS was validated and complies with both the: CSS and HTML 4.01 validators from W3C.
NOTE: All CSS validates except the "New Window Buttons" which include some invalid code (ie: hacks),
added PicoSearch Tables, and warnings for using transparent backgrounds when color foregrounds defined.
Copyright © 2003, 2004, 2005, 2006, 2007 by Bill Sanders / Full site last modified: October 21, 2006
Any reproduction, printing, or selling of this content is prohibited without express written consent from William D. Sanders.