Examining a U.S. Tax Scammer's Web Infrastructure through the DNS Lens

As 15 April 2024, the deadline for filing taxes in the U.S., draws near, it is not surprising that scammers have come out of their hiding holes once again. One particular U.S. tax scammer, in fact, has been reportedly going after small businesses and self-employed individuals.¹

Three domains have been identified as indicators of compromise (IoCs) for the threat. We expanded that list to identify other web properties that could be part of the threat actor’s attack infrastructure and uncovered:

• Nine email-connected domains
• One IP address that turned out to be malicious
• Nine domains that contained a string found among the IoCs

Fellow security researchers also noted the growing popularity of scams featuring fake tax preparers,² among other tax-related fraud, which we also looked into.

Download a sample of the threat research materials now or contact sales to discuss your intelligence needs for threat detection and response.

—

• [1] https://www.malwarebytes.com/blog/uncategorized/2024/03/tax-scammer-goes-after-small-business-owners-and-self-employed-people
• [2] https://www.washingtonpost.com/business/2024/03/06/irs-tax-preparer-fraud/