Sponsored by..

Monday 27 August 2012

"Federal Tax Payment" spam / videomanipulationccflbacklit.pro

This spam attempts to load malware from videomanipulationccflbacklit.pro although at the moment the domain is not resolving:

Date:      Mon, 27 Aug 2012 18:15:37 +0300
From:      "Internal Revenue Service" [irs@service.govdelivery.com]
Subject:      Federal Tax transaction canceled

Your Tax transaction (ID: 849395748011), recently sent from your checking account was canceled by the your financial institution.

Rejected Tax transfer
Tax Transaction ID:     849395748011
Return Reason     See details in the report below
FederalTax Transaction Report     tax_report_849395748011.doc (Microsoft Word Document)


Internal Revenue Service, Metro Plex 1, 8401 Corporate Drive, Suite 300, Landover, MD 20785

==========

Date:      Mon, 27 Aug 2012 16:41:45 +0200
From:      "Internal Revenue Service" [irs@service.govdelivery.com]
Subject:      Rejected Federal Tax payment

Your Tax transaction (ID: 13394702616857), recently initiated from your bank account was returned by the your Bank.

Rejected Tax transfer
Tax Transaction ID:     13394702616857
Reason for rejection     See details in the report below
Tax Transaction Report     tax_report_13394702616857.doc (Microsoft Word Document)


Internal Revenue Service, Metro Plex 1, 8401 Corporate Drive, Suite 300, Landover, MD 20785

==========


Date:      Mon, 27 Aug 2012 16:41:35 +0200
From:      "Internal Revenue Service" [support@govdelivery.com]
Subject:      Federal Tax payment canceled

Your Tax transaction (ID: 7227784606474), recently initiated from your bank account was returned by the The Electronic Federal Tax Payment System.

Rejected Tax transfer
Tax Transaction ID:     7227784606474
Reason for rejection     See details in the report below
FederalTax Transaction Report     tax_report_7227784606474.doc (Microsoft Word Document)


Internal Revenue Service, Metro Plex 1, 8401 Corporate Drive, Suite 300, Landover, MD 20785

I've seen a few .pro domains in spam recently, but they seem to get shut down quite quickly. I thought this TLD was meant to have more careful vetting?

No comments: