Texas property owners just received a postcard with the heading,|
"NOTICE OF ESTIMATED TAXES". This postcard is required by new state law to improve tax assessment transparency.
Dallas property owners received a special surprise however. The recipients are instructed to "Visit www.DallasCountyTexasTaxes.gov".
The indicated web page masquerades as a trusted .gov site but immediately redirects to a high-risk .com website in Bulgaria.
DO NOT VISIT THE LINK until Dallas CAD sorts this out.TECHNICAL EXPLANATION
Internet websites are addressed by numbers, similar to phone numbers. Some places have multiple numbers. Here are the numbers associated with the postcard website:
whois 2a00:1768:2001:63::46:113 person: NFOrce Internet Services - Administrative role account address: Postbus 1142 address: 4700BC Roosendaal address: The Netherlands phone: +31 (0)206919299 nic-hdl: NFAR mnt-by: MNT-NFORCE created: 2010-11-13T14:42:50Z last-modified: 2019-02-01T16:14:14Z source: RIPE # Filtered whois 2a0b:1640:1:1:1:1:c45:4c4f person: Boyan Peychev address: Andrei Lqpchev 1 fl 5 office 509 address: 1756 address: Sofia address: BULGARIA phone: +359885238998 nic-hdl: BP6205-RIPE mnt-by: bg-public-1-mnt created: 2017-05-24T14:26:07Z last-modified: 2020-04-26T15:50:50Z source: RIPE
We've reported the problem to Dallas County CAD and to the FBI.
In addition we have received cards from Denton, Live Oak, and Atascosa Counties. None of their websites masquerade as .gov entities and redirect to .com pages in foreign countries.
Dot gov domains require additional documentation to obtain and are therefore considered more trustworthy by users. For that reason if they can be redirected they are useful for confidence games.Special thanks to our ninjas B.B., Jason, D.B., and Chris.
As always, if you know something, say something, and say it to