The Tax Demand That Was Five Lines of Plain Text
ID: 7e92d9ef-a7a0-58ef-8c38-a3237b92dd9a
STIX ID: report--7e92d9ef-a7a0-58ef-8c38-a3237b92dd9a
Feed Name: IRONSCALES
Threat Score
**Executive summary:** A plain-text phishing email impersonating Israel's tax authority instructed a recipient to pay via the newly-registered apex domain `govilapp.com`; the message contained no HTML or tracking, passed SPF/DKIM/DMARC, and bypassed gateway markup checks but was flagged by link scanning and quarantined after a human verdict, indicating credential-harvesting/payment-fraud (MITRE T1566.002) using rapid domain registration and identity impersonation.
Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.