Examining a U.S. Tax Scammer's Web Infrastructure through the DNS Lens
As 15 April 2024, the deadline for filing taxes in the U.S., draws near, it is not surprising that scammers have come out of their hiding holes once again. One particular U.S. tax scammer, in fact, has been reportedly going after small businesses and self-employed individuals.1
Three domains have been identified as indicators of compromise (IoCs) for the threat. We expanded that list to identify other web properties that could be part of the threat actor’s attack infrastructure and uncovered: