IRS Phish Soliciting Donations for SoCal Wildfire Victims

The content of the message is a solicitation for donations for victims of the wildfires in Southern California. The top of the message has an IRS logo to make it appear legitimate (the logo is being loaded from customersarealways.com which does not have any IRS affiliation).

Here is a snippet of the message text which tries to lure the victim in:

For these Americans, every night brings uncertainty, every day requires new courage, and in the months to come will bring more than their fair share of struggles. In the task of recovery and rebuilding, some of the hardest work is still ahead, and it will require the creative skill and generosity of a united country. Right now California is asking you for help ! If you chose to take part in our program (initiated by IRS & U.S GOVERNMENT) click on the link below and make a small contribution. Together we can rebuild California ! BE HUMAN GET INVOLVED ! BE AMERICAN ! CALIFORNIA NEEDS YOUR HELP !

Sincerely, Julia Brownley

Of course the IRS does not send unsolicited emails looking for public donations to assist with relief efforts. In fact, it never sends unsolicited emails nor do they send anonymous emails. Just receiving an email such as this should always be the first tell-tale sign that the email is a scam and should not be acted upon.

From the sample that we received, the link at the bottom of the message directs the user to a web server hosted in France. When this link was followed the web page that was served was a broken redirect to a web page that is already offline.

This is not to say, however that this is a dead phish. Other variants of this message pointing to other sites likely exist and are being actively distributed.

The key point to remember here is that if the IRS wants to get a hold of you, they won't do it via email. They certainly wouldn't ask you for a donation via email. If you receive any examples of this scam, please forward it to the IRS at phishing@irs.gov.