{"id":8488,"date":"2026-04-02T07:15:00","date_gmt":"2026-04-02T12:15:00","guid":{"rendered":"https:\/\/www.dnsfilter.com\/blog\/the-tax-scams-the-irs-stopped-warning-you-about-are-still-growing"},"modified":"2026-04-02T07:15:00","modified_gmt":"2026-04-02T12:15:00","slug":"the-tax-scams-the-irs-stopped-warning-you-about-are-still-growing","status":"publish","type":"post","link":"https:\/\/ddi.mohflo.net\/index.php\/2026\/04\/02\/the-tax-scams-the-irs-stopped-warning-you-about-are-still-growing\/","title":{"rendered":"The Tax Scams the IRS Stopped Warning You About Are Still Growing"},"content":{"rendered":"


Four years of DNSFilter threat data reveals how cybercriminals are evolving their tactics \u2014 and why the government’s annual scam list only tells part of the story.<\/span><\/em><\/p>\n

<\/p>\n

Every March, the IRS publishes its<\/span> <\/span>Dirty Dozen<\/span><\/u><\/a> \u2014 a list of the top tax scams threatening taxpayers, businesses, and tax professionals. The 2026 edition, released on National Slam the Scam Day (March 5), includes the usual suspects: phishing, fake charities, ghost preparers, and misleading social media advice.<\/span><\/p>\n

But one change stood out. The IRS dropped fuel tax credit scams from the list, replacing them with a new entry: abusive undistributed long-term capital gains claims tied to Form 2439. That’s a scheme that plays out in fraudulent filings rather than malicious domains \u2014 a paperwork scam, not a web scam.<\/span><\/p>\n

At DNSFilter, we’ve been tracking tax-related threat domains on our network for four years. And our data tells a more complicated \u2014 and in some ways more concerning \u2014 story than the Dirty Dozen alone.<\/span><\/p>\n

The big picture: Scammers are getting more specific<\/span><\/strong><\/h2>\n

The most striking finding in this year’s data isn’t any single spike. It’s the shift in strategy.<\/span><\/p>\n

Threat domains containing the generic keyword “tax” in the domain name actually declined in Q1 2026 \u2014 down 46% from Q1 2025. But that decline is misleading. The scammers didn’t disappear. They diversified.<\/span><\/p>\n

Domains containing “filing” surged 275% year over year. Fuel-related threat domains grew 116%. And charity scam domains \u2014 which had been declining for two straight years \u2014 came roaring back. In other words, attackers are moving away from generic “tax” domain names and toward more targeted, believable keywords that are harder to spot at a glance.<\/span><\/p>\n

Fuel scam domains are still surging \u2014 even without the spotlight<\/span><\/strong><\/h2>\n

Fuel-related threat domains have been one of the most consistent growth stories in our tax season data. On the DNSFilter network, threat domains containing “fuel” in the domain name have climbed every year:<\/span><\/p>\n