How to Identify Phishing: "IRS" Case Study

Thank god I have experience with computers.  You see, I got this in my email this afternoon; and no, my spam trap didn't catch it (click to enlarge):

Sure looks legit, doesn't it?  Says it's from "not-reply@irs.gov,"  has an official looking banner...

But when I put my cursor over the "Click Here" hyperlink, it said (slightly edited to keep folks from clicking it):  ht*p://w*w.firenice.us/catalog/images/banners/secure/help.php

That's odd... why would the IRS employ a site called "firenice," let alone a non-secure site (i.e. http rather than https)?

I clicked anyway to see what was up. I wasn't concerned about inadvertently downloading malicious code since I figured the scammers wanted information, not a infectable host.  Clicking the link came up with this (also slightly edited to avoid accidents):

h*tp://203.231.156.2*2:7722/http.irs.g0v/irfofgetstatus.htm

Here's what the landing page looked like:

Also looks official, doesn't it?  The URL even says IRS.gov!  But look closer:

1.  Once again, it's not a secure website (look for https).
2.  Domain is an IP address, not language characters.
3.  IRS.gov is, in fact, spelled IRS.g0v.
4.  I smell phishy phish....

Then I clicked on "CONTINUE,"  and zoinks--look at all the info the "IRS" is looking for! 

Holy [PIGEONED]... mother's maiden name, credit card number. card security code... why does the IRS want my credit card?

Alas, the reason crooks still flood our email inboxes with phish is because they work.  I hate to imagine how many people will fall for this, and the people I really worry about are the ones who just want the computer to work and aren't willing to take time to understand the technology they're using.  All this coming from a pigeon who doesn't even own a cellphone!

Please pass this information on to those you think need it.  In fact, if you find any more IRS phishing sites the real IRS has a page where you can report it:  http://www.irs.gov/newsroom/article/0,,id=155682,00.html.  And yes, this link is legit!

---------------------------------------------------------------------------

Trackposted to Rosemary's Thoughts, third world county, Faultline USA, Nuke Gingrich, McCain Blogs, 123beta, Right Truth, Shadowscope, Pirate's Cove, The Pink Flamingo, Cao's Blog, The Amboy Times, , Democrat=Socialist, , Right Voices, and The Yankee Sailor, thanks to Linkfest Haven Deluxe.

Comments

[Rosemary]

Isn't this sad? Some people, if they'd only put their brains to legitimate use, would probably do very well. But noooooooo. They have to do this kind of stuff. Yes, very sad.

BTW, I don't open anything that looks official. They would have sent me a letter! Good grief. lol

[The Mad Pigeon]

Indeed... I figure if the IRS really wanted to take my money they'd just send goons to my house (MOGS style).

[MOGS]

"Indeed... I figure if the IRS really wanted to take my money they'd just send goons to my house (MOGS style)."

-- Hehehe, hey waitamin...I do not recall this event of which you speak.