ATTENTION ATTENTION

ATTENTION ATTENTION

Texas property owners just received a postcard with the heading,
"NOTICE OF ESTIMATED TAXES". This postcard is required by new state law to improve tax assessment transparency.

Dallas property owners received a special surprise however. The recipients are instructed to "Visit www.DallasCountyTexasTaxes.gov".

The indicated web page masquerades as a trusted .gov site but immediately redirects to a high-risk .com website in Bulgaria.

DO NOT VISIT THE LINK until Dallas CAD sorts this out.

TECHNICAL EXPLANATION
Internet websites are addressed by numbers, similar to phone numbers. Some places have multiple numbers. Here are the numbers associated with the postcard website:

2a00:1768:2001:63::46:113
2a0b:1640:1:1:1:1:c45:4c4f

The SCAMALYTICS report on number 2a00:1768:2001:63::46:113 states,

"If you see web traffic from this IP address there is potentially a high risk that it is criminals engaged in fraudulent activity."

These are the companies that run the computers at the location on the postcard.

whois 2a00:1768:2001:63::46:113
person:         NFOrce Internet Services - Administrative role account
address:        Postbus 1142
address:        4700BC Roosendaal
address:        The Netherlands
phone:          +31 (0)206919299
nic-hdl:        NFAR
mnt-by:         MNT-NFORCE
created:        2010-11-13T14:42:50Z
last-modified:  2019-02-01T16:14:14Z
source:         RIPE # Filtered

whois 2a0b:1640:1:1:1:1:c45:4c4f
person:         Boyan Peychev
address:        Andrei Lqpchev 1 fl 5 office 509
address:        1756
address:        Sofia
address:        BULGARIA
phone:          +359885238998
nic-hdl:        BP6205-RIPE
mnt-by:         bg-public-1-mnt
created:        2017-05-24T14:26:07Z
last-modified:  2020-04-26T15:50:50Z
source:         RIPE

We've reported the problem to Dallas County CAD and to the FBI.

UPDATE:
DCAD spokesperson Cheryl Jordan tells the ORP they contracted the service out to TrueProdigy. Their executives have not responded to our request for comment.

In addition we have received cards from Denton, Live Oak, and Atascosa Counties. None of their websites masquerade as .gov entities and redirect to .com pages in foreign countries.

Dot gov domains require additional documentation to obtain and are therefore considered more trustworthy by users. For that reason if they can be redirected they are useful for confidence games.

Special thanks to our ninjas B.B., Jason, D.B., and Chris.

As always, if you know something, say something, and say it to
WHISTLEBLOWER@openrecords.org.