Subscribe to RSS News Feed
About Spamhaus  |  Press Office  |  FAQs   
UK Tax Office Sends an Invitation to Phishers

2011-09-30 12:45:00 UTC   |   by Quentin Jenkins   |  
Recent News Articles

Spamhaus Botnet Threat Update: Q2-2020

Tracking Qbot

Spamhaus Botnet Threat Update: Q1-2020

The Current State of Domain Hijacking, and a specific look at the ongoing issues at GoDaddy

It was the best of times, it was the worst of times

Weaponizing Domain Names: how bulk registration aids global spam campaigns

Amazon Web Services - thwarting spam with a decade-old best practice

Spamhaus Botnet Threat Report 2019

Older News Articles:
Spamhaus News INDEX

Phishing. Broadly speaking, sending out emails which misdirect people to supply confidential information to miscreants. One such ruse in the UK has been to send out tax rebate emails purporting to come from the UK tax office, HMRC.

So on Friday, in a stroke of genius, HMRC sent out the following:

To our mind the key error here is supplying links in the email which can be altered behind the scenes to drop the unsuspecting onto malicious websites. While this email doesn't do that, it's setting up the expectation that HMRC will send out emails with inline links which people are expected to click on. If the link has been changed behind the scenes, where will you end up? Certainly not HMRC servers. More likely you'll end up on a site hosted in Russia or the Ukraine that pretends to be the UK's HMRC.

If you're security minded, you can look at the raw email at which point another "error" comes to the fore. The email doesn't actually come from HMRC's servers, it comes from:

Received: from 
(unknown [])
 by [cut] (Postfix) with ESMTP id [cut]
 for < [cut]>; Fri, 30 Sep 2011 12:14:54 +0100 (BST)
 Received: from CCGMSCTD ([]) by with Microsoft SMTPSVC(6.0.3790.4675);

Who are One has to assume they're the ESP ("Email Service Provider") appointed by HMRC to deliver their bulk email. Should one have to make these assumptions when we're talking about something as sensitive as tax?

And then in the final line, HMRC have set up the expectation that a similar email will be sent out in February 2012.

Surely to any self respecting phisher, this is a godsend? A couple of simple changes and you've got a very credible phishing email.

While we do appreciate the difficulties faced by organisations when wishing to communicate with their customer base via email, we'd put this one forward as a text book case as to how not to do it.

Spamhaus Information

Press Office
Spamhaus News Index
Spamhaus in the media
About Spamhaus
Spamhaus Official Statements
Article Information

Permanent link to this news article:
UK Tax Office Sends an Invitation to Phishers

Subscribe to RSS News Feed
Spamhaus News Quotes

Permission to quote from or reproduce Spamhaus News articles is granted automatically providing you state the source as Spamhaus and link to the news record.
© 1998-2020 The Spamhaus Project SLU. All rights reserved.
Legal  |  Privacy