As I was visiting SmishTank to report the most recent SMish that I had received (an iMessage from a +27 South African telephone number claiming to be from ParkMobile) I noticed there had been many recent submissions from the New York Department of Revenue. SmishTank is operated by Professor Muhammad Lutfor Rahman, a colleague of mine from our time at UAB, and his student Daniel Timko from California State University San Marcos.
 |
| SmishTank.com is a great resource for recent SMish! |
 |
| Pennsylvania and Connecticut “Department of Revenue” also observed |
 |
| The Utah State Tax Commission and the State of California Franchise Tax Board also seen |
SMish that Hide from Wrong Browsers
If you visit any of the URLs that are reported by these “Tax Refund” phish, you’ll find that they fail to resolve unless you are visiting from a phone. Researchers easily bypass this by using a “User Agent Switcher” which allows a browser, such as Chrome, to claim to be another device with a different browser. By setting myself to be an “Android KitKat” version of Chrome, the pages render on my Windows PC just fine. The User Agent Switcher also allows you to enter your own customer User Agents. Today, this is the one I used …
 |
| Mozilla/5.0 (Linux; Android 4.4.2; Nexus 4 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1847.114 Mobile Safari/537.36 |
New York Department of Revenue Mobile Phish (SMish)
The “Address” page of the phish starts by asking for a Social Security Number, which makes sense if you are interacting about taxation. With most “bank” phish, that would be an immediate Red Flag, but people who are interacting about taxes would not be alarmed by this. In the USA, your SSN is the primary identifier for taxes. Although the “State” is pre-populated to “New York” the footer still references the California Penal Code.
The next page tells me they would like to refund me $1120 and asks which Credit Card or Debit Card I would like to send the funds to. The “Bank Routing” option is unavailable, apparently due to “system maintenance.”
The website is using the Luhn algorithm to confirm that the credit card number is valid. Type any 16 digits starting with a 4 or a 5, then rotate the final number until it stops saying “invalid card number” in red and accepts the number. My made up number was 4381 6621 8355 371_ and when I changed the last digit to a “6” it became an acceptable Credit Card number. (I looked it up later, as this was entirely fictitious, but 438166 would mean my card was a Visa Credit Classic issued by Multicredit, S.A., in Guatemala. Oops! Its ok, the Chinese scammers didn’t care.)
How does the Stolen Credit Card get used?
In practice, the “bottom phone” would be somewhere in North America. The person using that phone would call a collaborator in Asia to say they are ready to make a purchase. The remote agent then taps one of the phones where your Phished credit card is loaded. That card is now “usable” on the phone in North America, who taps the phone locally to make a payment using the credit card 7500 miles away!
What Registrars, Hosts, and Domains are part of the current New York campaign?
And yet another domain pattern, also registered at Dominet (HK) Limited and also hiding behind Cloudflare uses this pattern:
revenue.refuAXCV[.]cc
revenue.refuREWJ[.]cc
revenue.refuDZSA[.]cc pivoting on that IP address, we can use Zetalytic’s ZoneCruncher to look at the passive DNS and find many other domains. Our TenCent phisher who is doing the New York Tax phish is clearly also doing Pennsylvania, and Minnesota! The Passive DNS also shows us other host and domain patterns for New York.
First seen on securityboulevard.com
Jump to article: securityboulevard.com/2025/09/new-smish-new-york-department-of-revenue/
