IRS Phishing Domains
IRS impersonation phishing is the #1 threat on IRS Dirty Dozen 2025 and 2026. Scammers register domains that mimic IRS branding to steal SSNs, bank details, and install malware via QR codes. The IRS only operates from irs.gov. Treat any unsolicited message linking to a non-irs.gov domain as suspicious.
Primary sources
•IRS Dirty Dozen 2026 — irs.gov
•IRS Dirty Dozen 2025 — irs.gov
•FTC Consumer Alert January 2026
Documented irs phishing domains
irs-tax-refund-portal.com
↳ IRScredential theft · first seen 2022
irs-account-verify.com
↳ IRSmalware · first seen 2023
irs-gov-security.com
↳ IRSmalware · first seen 2023
irs-taxpayer-services.com
↳ IRScredential theft · first seen 2023
irs-refund-portal.com
↳ IRScredential theft · first seen 2022
Other domain categories
People also search for
Frequently asked questions
What are irs phishing domains?▼
IRS impersonation phishing is the #1 threat on IRS Dirty Dozen 2025 and 2026. Scammers register domains that mimic IRS branding to steal SSNs, bank details, and install malware via QR codes. The IRS only operates from irs.gov. Treat any unsolicited message linking to a non-irs.gov domain as suspicious.
How do I verify if a domain is a legitimate irs phishing site?▼
Go directly to the official website by typing the URL yourself — never follow email links. Sources: IRS Dirty Dozen 2026 — irs.gov; IRS Dirty Dozen 2025 — irs.gov; FTC Consumer Alert January 2026.
Where do I report irs phishing domains?▼
Report to FTC at reportfraud.ftc.gov, FBI IC3 at ic3.gov, and the relevant agency (IRS phishing: [email protected]; SSA: oig.ssa.gov; USPS: [email protected]).
Received an email from a suspicious domain?
Check it instantly — free, no signup required.
Check your email →