Phishing sites impersonating IRS

PhishDestroy has recorded 12 phishing domains impersonating IRS since 2026-01-07, 0 of them in the last 30 days. The most used registrars are NameSilo and Cosmotown; the most common TLDs are .com and .info. Open IRS only from its official app or a saved bookmark.

12
Domains, all time
0
Last 30 days
6
Online at last check
2
Confirmed takedowns

New domains in the last 90 days

2026-07-25: 02026-07-26: 02026-07-27: 02026-07-28: 02026-07-29: 02026-07-30: 02026-07-31: 02026-08-01: 02026-08-02: 02026-08-03: 02026-08-04: 02026-08-05: 02026-08-06: 02026-08-07: 02026-08-08: 02026-08-09: 02026-08-10: 12026-08-11: 02026-08-12: 02026-08-13: 02026-08-14: 02026-08-15: 02026-08-16: 02026-08-17: 02026-08-18: 02026-08-19: 02026-08-20: 02026-08-21: 02026-08-22: 02026-08-23: 02026-08-24: 02026-08-25: 02026-08-26: 02026-08-27: 02026-08-28: 02026-08-29: 02026-08-30: 02026-08-31: 02026-09-01: 02026-09-02: 02026-09-03: 02026-09-04: 02026-09-05: 02026-09-06: 02026-09-07: 12026-09-08: 02026-09-09: 02026-09-10: 02026-09-11: 02026-09-12: 02026-09-13: 02026-09-14: 02026-09-15: 02026-09-16: 02026-09-17: 02026-09-18: 02026-09-19: 02026-09-20: 02026-09-21: 02026-09-22: 02026-09-23: 02026-09-24: 02026-09-25: 02026-09-26: 02026-09-27: 02026-09-28: 02026-09-29: 02026-09-30: 02026-10-01: 02026-10-02: 02026-10-03: 02026-10-04: 02026-10-05: 02026-10-06: 02026-10-07: 02026-10-08: 02026-10-09: 02026-10-10: 02026-10-11: 02026-10-12: 02026-10-13: 02026-10-14: 02026-10-15: 02026-10-16: 02026-10-17: 02026-10-18: 02026-10-19: 02026-10-20: 02026-10-21: 02026-10-22: 0
IRS phishing domains detected per day: 2 from 2026-07-25 to 2026-10-22; peak 1.

How to tell a fake IRS site

Words most often added to the brand in reported domains: tax, lrs, aldakheelholding, accountsreceivable, opentaxfile, irswebsiteislive, florina, krakanv, elreydistribuidor, dasainfra.

  • Type the address yourself or use a bookmark; phishing links for IRS arrive through ads, search results, direct messages and fake support accounts.
  • Check the full domain before you sign in: look for extra words, hyphens, a different TLD or look-alike letters.
  • IRS does not ask you to confirm your password or card details through a link in an email or SMS.

Paste a suspicious address into the Homoglyph Checker or check it against the DestroyList.

Latest IRS phishing domains

The 12 most recently detected domains impersonating IRS
DomainFirst detectedStatus at last checkRegistrar
irsassetprotection.com2026-09-07OfflineNAMECHEAP
cir-irs.online2026-08-10OnlineGlobal Domain
krakanv.com2026-06-15UnknownNICENIC
irsloan.info2026-05-28Taken downCosmotown
tax-en-lrs.ceylonicus.com2026-05-20OnlineNetEarth
dasainfra.com2026-05-19OnlineCV. Rumahweb Indonesia
tax-en-lrs.elreydistribuidor.com2026-05-19OnlineNameSilo
florina.digital2026-02-26OnlineSav.com
2025irswebsiteislive.live2026-02-23Offline—
opentaxfile.info2026-02-20OnlineNiceNIC
accountsreceivable.sbs2026-01-27OfflineNameSilo
aldakheelholding.com2026-01-07Taken downCosmotown

All 12 IRS reports

Where they are registered and hosted

Registrars

  1. NameSilo2
  2. Cosmotown1
  3. NiceNIC1
  4. Sav.com1
  5. NICENIC1
  6. CV. Rumahweb Indonesia1
  7. NetEarth1
  8. Cosmotown1

Top-level domains

  1. .com6
  2. .info2
  3. .sbs1
  4. .live1
  5. .digital1
  6. .online1

Hosting networks

  1. Cloudflare, Inc.3
  2. IS-AS-1, US1
  3. Interserver, Inc1
  4. HOST4GEEKS-LLC - Host4Geeks LLC, US1
  5. Neterra Ltd.1
  6. Cogent Communications, LLC1
  7. CV. Rumahweb Indonesia1
  8. H4Y Technologies LLC1

Related

Data: PhishDestroy domain-report database, built 2026-10-22. Counts cover every reported domain whose stored target brand is IRS; share of all PhishDestroy reports: 0.01%.