Monday 19 October 2009

ALERT: New HMRC phishing scam - new spam e-mail is out (11luoz.co.uk)

My spam trap has just registered this phishing email pretending to be from HMRC and providing a link which starts from a valid onilne.hmrc.gov.uk


Avoid clicking on this link!

Here is the offending spam email:


Return-path:
Envelope-to: x@x.com
Delivery-date: Mon, 19 Oct 2009 16:28:24 +0500
Received: from mta7.iomartmail.com ([62.128.193.157])
by x.com with esmtps (TLSv1:AES256-SHA:256)
(Exim 4.51 (FreeBSD))
id 1MzqPW-000Erk-8U
for x@x.com; Mon, 19 Oct 2009 16:28:24 +0500
Received: from mta7.iomartmail.com (localhost.localdomain [127.0.0.1])
by mta7.iomartmail.com (8.12.11.20060308/8.12.11) with ESMTP id n9JBSGsu006245;
Mon, 19 Oct 2009 12:28:17 +0100
Received: from 201-24-104-162.fnsce701.t.brasiltelecom.net.br (201-24-104-162.fnsce701.t.brasiltelecom.net.br [201.24.104.162])
by mta7.iomartmail.com (8.12.11.20060308/8.12.11) with ESMTP id n9JBSDc9006156;
Mon, 19 Oct 2009 12:28:15 +0100
Message-ID: <000d01ca50af$3d264ea0$6400a8c0@silkensen53>
From: "HM Revenue and Customs"
To:
Subject: Notice of Underreported Income
Date: Mon, 19 Oct 2009 09:28:10 -0300
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary="----=_NextPart_000_0007_01CA50AF.3D264EA0"
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2900.2180
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.2180

This is a multi-part message in MIME format.

------=_NextPart_000_0007_01CA50AF.3D264EA0
Content-Type: text/plain;
charset="Windows-1252"
Content-Transfer-Encoding: quoted-printable

Taxpayer ID: ufwsd-00000505794992UK
Tax Type: INCOME TAX
Issue: Unreported/Underreported Income (Fraud Application)
Please review your tax statement on HM Revenue and Customs (HMRC) website (=
click on the link below):

/online.hmrc.gov.uk.11luoz.co.uk/SecurityWebApp/httpsmode/statement.php?id=3D=
935603624415165971648683077233363052992296055238102320970584&email=3Dufwsd@=
djevans.co.uk&tid=3Dufwsd-00000505794992UK"

review tax statement for taxpayer id: ufwsd-00000505794992UK
HM Revenue and Customs


Domain 11luoz.co.uk has just been registered using a FAKE UK ADDRESS.

Here is the WHOIS Data:


Connecting to UK.whois-servers.net...


Domain name:
11luoz.co.uk

Registrant:
James Smith

Registrant type:
Non-UK Individual

Registrant's address:
5 Lower St Onslow
Winklebury
RG24 8HJ
United Kingdom

Registrar:
Webfusion Ltd t/a 123-Reg.co.uk [Tag = 123-REG]
URL: http://www.123-reg.co.uk

Relevant dates:
Registered on: 18-Oct-2009
Renewal date: 18-Oct-2011
Last updated: 18-Oct-2009

Registration status:
Registration request being processed.

Name servers:
No name servers listed.