Interactive Brokers Phishing Scam: Fake IRS W-8BEN Renewal Alert
ID: 449125bf-ae0e-541b-a4dc-a6f1f91e757a
STIX ID: report--449125bf-ae0e-541b-a4dc-a6f1f91e757a
Feed Name: Cofense Blog
Threat Score
**Executive summary:** Cofense Phishing Defense Center identified a phishing campaign impersonating Interactive Brokers that requests renewal of Form W-8BEN and directs victims to a fake login page (hXXps://wbnoebe.com?token=...), which harvests credentials and is associated with the IPs 104.21.64.219 and 172.67.187.230; users are advised to validate senders/URLs and enable MFA to reduce risk.
Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.