The Fake IRS Notice That Disproved Itself

A spoofed IRS “Your Tax Document(s) Is Now Available” phishing email landed at a commercial construction contractor; the forged notice included a contradictory tax-period detail that made the pretext falsifiable, an attacker-controlled CTA (https://imahdyirs.es/k/irx/irx.html), and inline branding artifacts (display name "IRS.GOV", fabricated To-header) — IRONSCALES quarantined the message roughly seven seconds after receipt, and the report provides IOCs, MITRE mappings (T1566.002, T1684.001, T1204.001), and three practical checks (policy awareness that the IRS does not email notices, verify internal detail table claims, and treat authentication of a sending domain as independent from in-body branding).