# Phishing sites impersonating IRS

PhishDestroy has recorded 12 phishing domains impersonating IRS since 2026-01-07, 0 of them in the last 30 days. The most used registrars are NameSilo and Cosmotown; the most common TLDs are .com and .info. Open IRS only from its official app or a saved bookmark.

12Domains, all time

0Last 30 days

6Online at last check

2Confirmed takedowns

## New domains in the last 90 days

IRS phishing domains detected per day: 2 from 2026-07-25 to 2026-10-22; peak 1.

## How to tell a fake IRS site

Words most often added to the brand in reported domains: tax, lrs, aldakheelholding, accountsreceivable, opentaxfile, irswebsiteislive, florina, krakanv, elreydistribuidor, dasainfra.
- Type the address yourself or use a bookmark; phishing links for IRS arrive through ads, search results, direct messages and fake support accounts.
- Check the full domain before you sign in: look for extra words, hyphens, a different TLD or look-alike letters.
- IRS does not ask you to confirm your password or card details through a link in an email or SMS.

Paste a suspicious address into the [Homoglyph Checker](https://phishdestroy.io/developer-tools/homoglyph-checker) or check it against the [DestroyList](https://phishdestroy.io/developer-tools/destroylist-check).

## Latest IRS phishing domains

The 12 most recently detected domains impersonating IRS
Domain | First detected | Status at last check | Registrar | 
[irsassetprotection.com](https://phishdestroy.io/domain/irsassetprotection.com/) | 2026-09-07 | Offline | NAMECHEAP | 
[cir-irs.online](https://phishdestroy.io/domain/cir-irs.online/) | 2026-08-10 | Online | Global Domain | 
[krakanv.com](https://phishdestroy.io/domain/krakanv.com/) | 2026-06-15 | Unknown | NICENIC | 
[irsloan.info](https://phishdestroy.io/domain/irsloan.info/) | 2026-05-28 | Taken down | Cosmotown | 
[tax-en-lrs.ceylonicus.com](https://phishdestroy.io/domain/tax-en-lrs.ceylonicus.com/) | 2026-05-20 | Online | NetEarth | 
[dasainfra.com](https://phishdestroy.io/domain/dasainfra.com/) | 2026-05-19 | Online | CV. Rumahweb Indonesia | 
[tax-en-lrs.elreydistribuidor.com](https://phishdestroy.io/domain/tax-en-lrs.elreydistribuidor.com/) | 2026-05-19 | Online | NameSilo | 
[florina.digital](https://phishdestroy.io/domain/florina.digital/) | 2026-02-26 | Online | Sav.com | 
[2025irswebsiteislive.live](https://phishdestroy.io/domain/2025irswebsiteislive.live/) | 2026-02-23 | Offline | — | 
[opentaxfile.info](https://phishdestroy.io/domain/opentaxfile.info/) | 2026-02-20 | Online | NiceNIC | 
[accountsreceivable.sbs](https://phishdestroy.io/domain/accountsreceivable.sbs/) | 2026-01-27 | Offline | NameSilo | 
[aldakheelholding.com](https://phishdestroy.io/domain/aldakheelholding.com/) | 2026-01-07 | Taken down | Cosmotown | 

[All 12 IRS reports](https://phishdestroy.io/domain/?brand=IRS)

## Where they are registered and hosted

### Registrars

- [NameSilo](https://phishdestroy.io/registrar/namesilo/)2
- [Cosmotown](https://phishdestroy.io/registrar/cosmotown/)1
- [NiceNIC](https://phishdestroy.io/registrar/nicenic/)1
- [Sav.com](https://phishdestroy.io/registrar/sav-com/)1
- [NICENIC](https://phishdestroy.io/registrar/nicenic/)1
- CV. Rumahweb Indonesia1
- NetEarth1
- [Cosmotown](https://phishdestroy.io/registrar/cosmotown/)1

### Top-level domains

- [.com](https://phishdestroy.io/tld/com/)6
- [.info](https://phishdestroy.io/tld/info/)2
- [.sbs](https://phishdestroy.io/tld/sbs/)1
- [.live](https://phishdestroy.io/tld/live/)1
- [.digital](https://phishdestroy.io/tld/digital/)1
- [.online](https://phishdestroy.io/tld/online/)1

### Hosting networks

- Cloudflare, Inc.3
- IS-AS-1, US1
- Interserver, Inc1
- HOST4GEEKS-LLC - Host4Geeks LLC, US1
- Neterra Ltd.1
- Cogent Communications, LLC1
- CV. Rumahweb Indonesia1
- H4Y Technologies LLC1

## Related

- [Typosquatting](https://phishdestroy.io/glossary/typosquatting/)
- [Homoglyph](https://phishdestroy.io/glossary/homoglyph/)
- [Phishing kit](https://phishdestroy.io/glossary/phishing-kit/)
- [Homoglyph Checker](https://phishdestroy.io/developer-tools/homoglyph-checker)
- [Abuse Report Generator](https://phishdestroy.io/developer-tools/abuse-report-generator)
- [If you already used a fake site: emergency guide](https://phishdestroy.io/critical-action)
- [All impersonated brands](https://phishdestroy.io/brand/)

Data: PhishDestroy domain-report database, built 2026-10-22. Counts cover every reported domain whose stored target brand is IRS; share of all PhishDestroy reports: 0.01%.

Canonical: https://phishdestroy.io/brand/irs/