IRS rebate scam

If you ever get somethign in your email that suggests it is the Government, your bank etc. Do NOT fall for these scams. Do not click on the links, and do NOT contact or reply to the sender.

Report the Email to IC3, the web server/host, etc. If more people reported these scams, less ignorant people would get scammed. Sure we may think only greedy, or ignorrant, people fall for these things. But the fact is I have recieved letter from my readers who have been effected by these scams. After the damage is done there is very little help I can offer, and in most cases the people lost money and their sense of security, which, they likely will never reteive.

To that I say it may be your child or grandparent that falls for one of these scams someday - Then what will you say? Talk to your friends, family, and the children. Inform and instruct them how to spot and deal with these problems.

IRS Scam Mail example

I got this in my Email today:

-----------------------------------------------------------

After the last annual calculations of your fiscal activity we have determined that you are eligible to receive a tax refund of $129.72. Please submit the tax refund request and allow us 3-6 days in order to
process it.

A refund can be delayed for a variety of reasons.
For example submitting invalid records or applying after the deadline.

To access the form for your tax refund, please click here

Note: For security reasons, we will record your ip-address, the date and time.
Deliberate wrong inputs are criminally pursued and indicated.

Regards,
Internal Revenue Service

Copyright 2007, Internal Revenue Service U.S.A. All rights reserved.

-------------------------------------------------------------

Regarding this email I held my mouse curser over the link to see where it went. The link pointed to the following adreess:

http://www.softics.ro/catalog/*******/redir.php

So I decided to type softics into google. I found 1,200 links. See the (".ro") at the end of the main web site address) This is called the "extension"/ Normally you will see a .com etc here. But there is also Country extensions here is a list of different extensions and what they represent:

http://www.tamingthebeast.net/articles2/countrycode.htm

The web site is a Romanian

The Email "sender" was indicated as being from (according to my yahoo emial sender summary):

service@irs.gov

This is something the scammers do they will make it look like it was sent from a reliable source like Ebay or paypal. They lie. Also notice how at the end of the web address there is "/redir.php"?

Well the "redir.php" indicates that when you click on the link it will redirect you to a different web site, and not the website that you see if you place cuser over link (PLEASE BE CAREFUL AND DON'T CLICK THE LINK) At the bottom left of browser window - you should be able to see the website the link goes to.

Also I looked at the (full header) in my email browser. The full header indicated that the Originating IP address was - 66.252.160.48

Country: UNITED STATES (US) City: New York, NY

Another IP lookup address lookup software found this

mail.fsfm-law.com
 Country USA

The recieved Address was 213.42.26.139

I loked this one up and found

Host  : ?
 
Country  : United Arab Emirates
 

I also did a search to see who owns the domain name, here is what I found.

domain-name: softics.ro
description: PETRE Constantin
description: bd. Unirii bl. E17, sc. B, et. 1, ap. 28
description: Slobozia
description: RO
description: Postal Code: 920022
description: Phone: +40-743-117678
description: Email:
description: [...]
admin-contact: PC23-ROTLD
technical-contact: PC23-ROTLD
zone-contact: PC23-ROTLD
billing-contact: PC23-ROTLD
nameserver: ns3.inregistrari.ro 193.25.112.66
nameserver: ns4.inregistrari.ro 193.25.113.66
info: Registered via inregistrari_ro
info: object maintained by ro.rnc local registry
notify:
object-maintained-by: ROTLD-MNT
updated: 20050127
updated: 20050127
source: ROTLD
application-date: 20050126
domain-status: activ

person: PETRE Constantin
address: PETRE Constantin
address: bd. Unirii bl. E17, sc. B, et. 1, ap. 28
address: Slobozia
address: RO
address: Postal Code: 920022
address: [...]
phone: +40-743-117678
e-mail:
nic-hdl: PC23-ROTLD
notify:
object-maintained-by: ROTLD-MNT
updated: 20050127
updated: 20050127
source: ROTLD

Multiply - Algerian Bank Scam

OK well I didn't expect this but it has already happened. Here is a copy paste of the first scam phishing bank scam I recieved here. This type of scam (below) is called an Agerian bank scam.

Be sure not to click on the web site (actually I will remove their links from the paste) Be sure not to respond or open pages or web site from anyone who sends what looks like a scam. Even if it E-mailed from a friend. If you receive one from a friends E-mail, kick them a couple times, call them names, have them remove your name from their email list, and then educate them on computer security. If you open a web site from a phisher/scamer you are taking risks with your computer security. Flash and many friends / social networks do have holes that attackers can abuse, so be carefull out there in cyber space.

 

Dec 14, '07 10:02 AM for users ianbach and susnagbe

My Dear,

I know that this letter might be a suprise to you but do consider it as emergency. I am Miss Susan Markson from Liberia Monrovia 24 years old and i reside here in Senegal with my sick mother. We are here in Dakar Senegal because of the fund $5.5 million my late father deposited in the finance house which we want to transfer out from here to your country for investment. Please reply me for further clarification. I need your urgent assistance please. I do hope to hear from you soon.

Thanks.

Miss. Susan Markson.

 

Never give up never surrender

I decided that because there is so many times that I want (or need) to vent and times I just want to get stuff off my chest. It is bad to keep stuff bottled up inside and publishing my personal life on my counter terrorism Blog is not the place for it.

I don't want to distract from my goals here about creating awareness and bring real News, and News about good things that the Media doesn't talk about.

I also want to keep this Blog focused on my most important goal of exposing terrorist propaganda and creating awareness.

I also plan to start to add info here on yahoo360 on how to stay safe while surfing the web, how to ignore/block unwanted comments from jerks, and mean people. I will attempt to teach how to keep you and your computer safe and clean from spyware, viruses, phishing, bank scams, and identity theft.

So I am not sure if anyone wants to see the other side of me but I decided to create a Journal Blog. It feeds to my dot com (www.ianbach.com).

The Address for the Journal is http://www.ianbach.com/journal/

I lived with Mormons for almost 3 years back when I was young about 19-21. They are good people and the focus on family life and personal wellness. This is something that should be praised. They are taught to be very ethical, honest, good humans. One thing I learned was that they promote writing a Personal Journal and I do believe and all of them or anyone who keeps a journal will tell you that it helps them in many ways. - Ian Bach