Yobunny client support forums

Tech Support Forums => Security, Vulnerabilities, Alerts - Stay Safe! => Topic started by: Anne on March 24, 2009, 12:52:21 PM

Title: Phishing email: The Government give money back with tax refund
Post by: Anne on March 24, 2009, 12:52:21 PM

Heads up for a possible new phishing scam starting...
We received an email today which pretended to come from the UK's Income Tax service but it doesn't.  Checking the link in the email shows it's currently not active, but that's not to say it will never be, so if you receive one of these emails be aware that it is a possible phishing attempt. 

Note especially the line in the headers as follows:
Authentication-Results: mta127.mail.ird.yahoo.com  from=hmrc.gov.uk; domainkeys=neutral (no sig); from=hmrc.gov.uk; dkim=neutral (no  sig)

Headers from the email are as follows... (my email address munged to protect it)...

Quote

X-Apparently-To: xxxx@yahoo.co.uk via 87.248.115.81; Tue, 24 Mar 2009 09:12:27 +0000
X-YMailISG: FZeeoR8WLDuS5Hm41LI.1NUjIJgwk1NRpgduZaPWp.V8OltO4olnHOW_HybPJ4MfhYh9xFh_a.b7YJ5lQyIWzl0opqohA3VWtlNM9Fabjypv.obIEUFINGroy52DLCPGtX5E1S0Kv50_g8eCC7cJo4ONTeZT8ZhyqfYIRyjgytRrVNj5rm_Ac0vpTD15aj5N5845ZSVBiingk.R3_Bb42BAsFYq0iNPDKu4iZjms0lvyP0XKrvpU_o1zw1cmbLWYoVXbRpkST8hRa6mzIZy6Zkkz4Dtoo_tOXIaDxlL9gDxIcwU4oP8IP4poUdrwClJExKQrh_WSfTHRzaM2bdeJJTy5igIRcIpOdHz33UYbM6e3i7bnnwd7s5kIuus07AOGOQBhnyE2m5X1lFMsxYem1.TLQ8Gt3XAfmiY_pCqeHuia61_1ZIBbsXNvWPXD7VayF.T3CSr34_XERtRBniaFDdQUy3ZxAukvJsHyUK2JBx5U4dEF7HyoeNYj
X-Originating-IP: [218.106.205.202]
Authentication-Results: mta127.mail.ird.yahoo.com  from=hmrc.gov.uk; domainkeys=neutral (no sig); from=hmrc.gov.uk; dkim=neutral (no  sig)
Received: from 218.106.205.202  (HELO eyou.net) (218.106.205.202)
  by mta127.mail.ird.yahoo.com with SMTP; Tue, 24 Mar 2009 09:12:27 +0000
X-EYOU-SPAMVALUE:0
Received: (eyou anti_spam gateway 3.0); Tue, 24 Mar 2009 15:50:49 +0800
Message-ID: <437881049.18558@eyou.net>
X-EYOUMAIL-SMTPAUTH: @
Received: from 88.60.110.57 by 218.106.205.202 with SMTP; Tue, 24 Mar 2009 15:50:49 +0800
Reply-To: <no-repley@hmrc.gov.uk>
From: "HM Revenue & Customs"<hmrc@hmrc.gov.uk>
Subject: The Government give money back with tax refund
Date: Tue, 24 Mar 2009 10.12.23 +0100
MIME-Version: 1.0
Content-Type: text/html;
        charset="Windows-1251"
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2600.0000
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000
X-Antivirus: avast! (VPS 090323-0, 23/03/2009), Outbound message
X-Antivirus-Status: Clean

<a href="http://refund.hmrc.gov.uk.hmrce-gov-uk.com/tax-refund/refund.php"><img src="http://hmrce-gov-uk.com/scr.PNG" border="0" alt=""></a>