JK Computer Consulting dba JKCC

Phishing email of the day is a fake email from the IRS requesting a signature on a DocuSign file. There are a number of things that are suspicious about this email but let's break it down:
1. From: IRS Gov (this is not the IRS's official domain name, they use IRS. gov)
2. The URL for "view file" leads to a suspicious URL: https://adbfs. de/mm/Updatemail. htm
3. Check the "headers"
a. "Return-path:" - (again, not IRS.gov)
b. "Received:" Received: from kagoya .net (act03.kagoya. net [133.18.75.69])
by smtp2.kagoya .net (Postfix) with ESMTPA id 1913A60687CA4;
Tue, 25 Nov 2025 06:04:09 +0900 (JST) - (I google search the IP address and it's Japanese)
4. Last, when you turn off "HTML" or enable "plain text" you can see some odd formatting of the text:
docusign (why is this lowercase?)
New File Available
IRS have Sent You An Important Document To Review. (why "have" vs. "has" and why cap "S")
View File
Use the DocuSign Mobile App for a better experience.
This email contains important document info. Keep it safe. (Why "info" vs "information"?)
DocuSign
| © 2025 copyright and affiliates. All Rights Reserved. | Microsoft Corp., Redmond, WA 98052
(When did Microsoft get into the IRS business?)

We’re fast approaching the “scam” season! Ok, who am I kidding, it never seems to stop. 🤓 there are a number of approaches they are using to trick you into giving away money or information. Be aware.

- Phone calls that appear to be local but typically are just voip services providing a local number. They want you feel safe that it’s someone nearby.
- Phone numbers appear to be from your financial institution but are not. They spoof the real phone number but don’t typically act or sound like employees. If you tell them you’ll call back their number (the legit number) at a later time they either bail or try to pressure you to talk now. Don’t.
- Similar techniques are used in emails, they appear to be from a known name or company but when you mouse over the email address or the buttons/links in the email, they point to something slightly off or complete gibberish. It’s best to mark these as spam and block. You can always go to the official website or call the company to confirm.
- Pop-ups are pretty common, you’ll visit a web page and a pop up screen appears to have taken control of your computer. They typically are just persistent and block your view. The best thing to do is open task manager and close the window. Don’t click on anything in the window. At this point they’re just trying to scare you into clicking or calling. Don’t.

Overall the techniques are a bluff, they want you to be emotionally compromised so you can’t think rationally about the situation. There’s nothing that can’t wait for you take a moment to research it or validate the contact. Please be safe out there!

If you’re in doubt and don’t have anyone to consult please feel free to reach out.
🤓

A slightly different phishing email scam, although we've seen this general approach before, this one looks "almost" legit. Please take note of a few things that are suspect about this:
- Sending email address: Norton doesn't use a Gmail account to send correspondence
- Phone number: Norton isn't based in Hawaii
- Message body: The message indicates our coverage is expiring yet the message is indicating that the order has been complete
- General grammar: "If you didn't ordered it" (oops) and "Feel Free" (no need to cap "Free")

Always be cautious, don't click or call without making sure it's legit by verifying at the known good website. It's easy enough to see if there are any unauthorized charges on your accounts too.

Good news.. our financial worries are gone forever! (read below for a recent example of the 'foreign prince' scam)

Hello,
I know that this message may come to you as a surprise, I came across your email contact from my personal search, and I am happy to contact you this way. My name is Mrs. Massar Mambo, I am from the republic of South Sudan. I want you to assist me on my investment project, which I intend in your country.
About me, I had two children for my late husband, my husband and one of our child were killed when the rebels attacked our house in Juba. After that incident, I left the country to this country Cote d’Ivoire with my only child, and with the help of the UN, currently we are in the refugee campsite.
I want you to fill the place of my late husband’s foreign partner, and receive the fund, and we will come over to you, for the investments. I have decided to offer you 25% of the entire fund, 12.4M.USD (Twelve Million, Four hundred thousand, United States dollars) the amount is in the bank here.
Once I receive your positive reply, I will inform the bank director, for the process of transfer to your account.
I wait for your reply.
Thanks,
Mrs. Massar Mambo.
email: ([email protected].)