Topic starter
25/10/2026 11:06 am
TL;DR: 95% of TurboTax impersonation fell over three years, while filing-themed domains rose 275%, in DNSFilter data. Blocklists need behavioural and fraud signals, because tax scam domains are now built to look official.
Editorial analysis by NHI Mgmt Group, based on content published by DNSFilter: “The Tax Scams the IRS Stopped Warning You About Are Still Growing”.
By the numbers:
- Threat domains containing "tax" in the domain name declined 46% from Q1 2025 to Q1 2026.
- Domains containing "filing" surged 275% year over year.
- Charity-related threat domain traffic surged 793% over the prior year.
Key questions
Q: Why do official-sounding scam domains create more risk than obvious lookalikes?
A: Because users and filters both rely on quick trust cues.
Q: What are the signs that seasonal phishing campaigns are adapting instead of fading?
A: Watch for growth in new keyword families, concentrated registration spikes, and a shift from brand impersonation to generic service language.
Q: How should security teams handle believable tax scam domains during filing season?
A: Treat them as a trust and fraud problem, not only a domain-blocking problem.
Practitioner guidance
- Harden DNS-layer filtering for seasonal fraud spikes Raise scrutiny on newly registered tax-related domains during filing season, especially domains using official-sounding words like filing, state, fuel, or charity.
- Block trust-mimicking domain patterns before they spread Create detection rules for .com sites impersonating government or tax portals, and treat subtle public-sector lookalikes as higher risk than obvious misspellings.
- Combine fraud and phishing telemetry Correlate DNS events with payment abuse, credential theft, and account takeover indicators so a tax lure is handled as an identity and fraud event, not only a web threat.
Bottom line: Tax scam operations are becoming harder to spot because the most effective lures now sound official rather than obviously fake.
Glossary terms: Trust-Signal Fraud, Seasonal Phishing, Domain Churn, Fraud Telemetry
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 7 days ago by NHI Mgmt Group
27/10/2026 7:17 pm
Believable naming is now the core evasion technique in tax fraud campaigns. The shift away from generic tax terms toward filing, fuel, and charity language shows that attacker success increasingly depends on perceived legitimacy, not brand theft alone. That changes the defender’s job from blocking known bad names to recognising trust-signalling language across newly registered domains. The operational implication is simple: credibility is now a security signal, not just a marketing one.
A question worth separating out:
Q: When should organisations keep tax scam protections active after the filing deadline?
A: They should keep protections active through and beyond the deadline whenever attackers continue registering fresh domains or when filing extensions, refund claims, or charity-related lures remain active. Seasonal fraud rarely ends on a calendar date, so monitoring should follow observed activity, not the public filing window.
👉 Read our full editorial: Tax scam domains are shifting from generic names to believable lures
This post was modified 7 days ago by NHI Mgmt Group