small botnet spoofs USA IRS

Post Reply
NotBuyingIt
Posts: 6587
Joined: Fri Mar 11, 2011 6:21 pm

small botnet spoofs USA IRS

Post by NotBuyingIt » Tue Aug 12, 2014 3:52 pm

A groups of similarly named fraudulent web pages spoof the Internal Revenue Service (IRS) USA government tax site. Those listed below have all been reported to PhishTank. For example, see https://www.phishtank.com/phish_detail.php?phish_id=2616027
<!--break-->

List of domains/hosts

91.219.29.147/irs/
107.181.161.165/irs/
185.14.28.90/irs/
irg-billling.com/irs/
ipc-billling.com/irs/
irk-billling.com/irs/
irs-billllng.com/irs/
lrs-billling.com/irs/

Perhaps a small botnet is involved. Apparently, the DNS for the scams is currently provided by
a.dnspod.com [IP 112.90.141.215]
b.dnspod.com [IP 183.60.52.90]

The sites are newly registered through TODAYNIC.COM, INC., using "Whois Privacy Protection Service" to conceal their criminal activities.

NotBuyingIt
Posts: 6587
Joined: Fri Mar 11, 2011 6:21 pm

RE: small botnet spoofs USA IRS

Post by NotBuyingIt » Tue Aug 12, 2014 4:17 pm

List of domains/hosts

5.34.183.170/irs/
irc-killling.com/irs/
irq-billling.com/irs/
jrs-billlling.com/irs/


Please be aware that (perhaps unlike the most common phishing scams) malicious botnets are more likely to spread malware along with their scams. I suspect that the sites may be dangerous to visit.

NotBuyingIt
Posts: 6587
Joined: Fri Mar 11, 2011 6:21 pm

RE: small botnet spoofs USA IRS

Post by NotBuyingIt » Wed Aug 13, 2014 4:40 am

irc-killling.com/irs

Post Reply

Who is online

Users browsing this forum: No registered users and 13 guests