Click Here to learn about the StopScamFraud team of volunteers. Click Here to read more about this website.

Interactive Brokers - Phishing Scam - support@mrqxi.com / fhqsnip.com

Unfamiliar with this type of scam? See Here.
NOTICE: The Emails Below Are All Scams.
Click here to read why the email below is definitely a scam. Click here for more information about this particular type of scam.
Post Reply Previous topic Next topic
User avatar
Beezwax
The Sentinel
The Sentinel
Posts: 3319
Joined: 25 Jan 2020

Interactive Brokers - Phishing Scam - support@mrqxi.com / fhqsnip.com

Post by Beezwax »

From: Interactive Brokers <support@mrqxi.com>
Date: Thu, 09 Oct 2025 13:18
Subject: Your Tax Residency Information Needs Updating

Your Tax Residency Information Needs Updating

Dear Client,

To protect you from potential over-withholding and ensure your information is fully up to date, we are requesting that you renew your W-8BEN form.

This form certifies your non-U.S. status and is a legal requirement under IRS regulations. A current W-8BEN helps confirm your eligibility for reduced withholding rates under applicable tax treaties.

Renewal is quick, secure, and vital to ensuring accurate reporting.

Update Tax Information >>> https://fhqsnip.com/?token=VnDDRvTYqpPAXxG6623tK

Please complete your update at your earliest convenience to maintain full account functionality.

Interactive Brokers
This communication is for information purposes only and not a solicitation to buy, sell or hold any investment product. Customers are solely responsible for their own decisions.
Interactive Brokers, member NYSE, FINRA, SIPC Home Contact Unsubscribe

fhqsnip.com is a fraudulent internet domain name being used by scammers for criminal purposes such as advance-fee fraud, phishing and email message scams. Any email addresses and/or websites associated with this domain name are fraudulent and illegal. Also, any URL or website links associated with this domain could be malicious and harmful to your computer and/or your mobile device and should be completely avoided.

mrqxi.com is a fraudulent internet domain name being used by scammers for criminal purposes such as advance-fee fraud, phishing and email message scams. Any email addresses and/or websites associated with this domain name are fraudulent and illegal. Also, any URL or website links associated with this domain could be malicious and harmful to your computer and/or your mobile device and should be completely avoided.
FRAUD WARNING: The above information is being provided as a fraud warning. Do not contact the sender of the above email. The source of this information is from a scammer who is a criminal imposter. Any names of real people being used within the above information from this imposter is unauthorized and illegal. Do not provide this scammer any of your personal information. Do not send them any of your personal identity documents. Do not send them any money. Do not call any phone numbers that they provide to you. This email, and all of its content, are part of a fraudulent, criminal act and the only intention of the scammer who sent this email is to steal money from you and to obtain personal information leading to identity theft of the scam victim. If you received the same email (or one very similar) then stop all communication with the scammer immediately. All claims made within the email are lies fabricated by a fraudster and this criminal will never provide you any money, assets, investments, property, commodities, merchandise, employment, romance, or anything of value. Every email scammer uses a completely false identity, thus their names used in the email (and any company name, employment, occupation, street address and/or location information that they provide) is 100% fake. Any photos, scans of passports or other personal identity documents and/or any other documents (government, corporate, legal, financial, etc) or forms that they send to you are all stolen, fake and/or forged and the file attachments they send with their scam emails may also contain viruses. Also avoid all website links that any scammer sends to you because their websites are all fraudulent and may also contain hidden Malware, Trojans, Spyware and/or key loggers. In conclusion, do not send any money to this scammer or you will lose it permanently. Contact with this scammer also places you at risk of identity theft and having your identity wrongfully used for illegal activities, which can place you in legal, financial, and physical danger. Click here to read what qualifies the above email as a scam. Scroll up and click the link at the top of this page for more information about this particular type of scam. Click here if you had interactions with a scammer and need support.
Top
User avatar
Beezwax
The Sentinel
The Sentinel
Posts: 3319
Joined: 25 Jan 2020

Interactive Brokers - Phishing Scam - support@mrqxi.com / fhqsnip.com

Post by Beezwax »

Origin of scam email is from server in Germany. Full headers:

Return-Path: <support@mrqxi.com>
Delivered-To: [REDACTED]
Received: from [REDACTED]
by [REDACTED] with LMTP
id uD0UHiO252gjQw0AQfkzaw
(envelope-from <support@mrqxi.com>)
for <[REDACTED]>; Thu, 09 Oct 2025 13:18:27 +0000
Return-path: <support@mrqxi.com>
Envelope-to: [REDACTED]
Delivery-date: Thu, 09 Oct 2025 13:18:27 +0000
Received: from [85.142.91.171] (helo=mail.mrqxi.com)
by [REDACTED] with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384
(Exim 4.98.2)
(envelope-from <support@mrqxi.com>)
id 1v6qXH-00000003i13-1kW3
for [REDACTED];
Thu, 09 Oct 2025 13:18:27 +0000
DKIM-Signature: v=1; a=rsa-sha256; d=mrqxi.com; s=dkim; c=relaxed/relaxed;
bh=1vfNULUk2SXb64d7E9xMouKLORE13PcHyK4LkPsDEog=;
h=from:to:subject:date:message-id:sender; t=1760015902;
b=K/DfrB5fQToZkxAzLbgbkC6k8EPkL0ZTsoOKP5pvMHeiFir3ulZVLj+RwWzQeYKnpbmpYeKXk
t5MBN7y3En3mW8oyQhu5XaAi/svcRF+qYqofxUP02E0q8+Lgc1NDOoOjNr2BrZaf8yWN4wguIyg
BvZrpknddwviEUqsQnvzoX+upGO8zYwasB6jp1ixB1enLUZ3tZ53OIcKdy0Cj84aK5yxn33YzZK
VI3ykIwMlRMHC6YQloIpL48Mh6SnatKahCcEI2Nt+BOzZXOpII+u+kfoPG8iaPqrT+InCDOaPhR
R3/dAj2XqZ4GOAZJvQ4MFNaR4EU4DRImFgbiUe8aeBPg==;
From: Interactive Brokers <support@mrqxi.com>
To: [REDACTED]
Subject: Your Tax Residency Information Needs Updating
Date: Thu, 09 Oct 2025 13:18:22 +0000
List-Unsubscribe: <https://127.0.0.1/unsubscribe?email=[REDACTED]>
List-Unsubscribe-Post: List-Unsubscribe=One-Click
X-Mailer: Apple Mail (2.3445.9.1)
Message-ID: <176001590233.16780.15273647518798197591@127.0.0.1>
Content-Type: multipart/alternative;
boundary="===============7576474034696648761=="
X-Spam-Status: No, score=-1.5
X-Spam-Score: -14
X-Spam-Bar: -
X-Ham-Report: Spam detection software, running on the system "[REDACTED]",
has NOT identified this incoming email as spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: Your Tax Residency Information Needs Updating Your Tax Residency
Information Needs Updating Dear Client, To protect you from potential over-withholding
and ensure your information is fully up to date, we are requesting that you
renew your W-8BEN form.
Content analysis details: (-1.5 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
0.0 URIBL_DBL_BLOCKED_OPENDNS ADMINISTRATOR NOTICE: The query to
dbl.spamhaus.org was blocked due to usage of an
open resolver. See
https://www.spamhaus.org/returnc/pub/
[URI: fhqsnip.com]
[URI: www.interactivebrokers.com]
[URI: mrqxi.com]
0.0 URIBL_BLOCKED ADMINISTRATOR NOTICE: The query to URIBL was blocked.
See
http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
for more information.
[URI: interactivebrokers.com]
[URI: fhqsnip.com]
[URI: mrqxi.com]
0.0 RCVD_IN_ZEN_BLOCKED_OPENDNS RBL: ADMINISTRATOR NOTICE: The query to
zen.spamhaus.org was blocked due to usage of an
open resolver. See
https://www.spamhaus.org/returnc/pub/
[85.142.91.171 listed in zen.spamhaus.org]
1.3 RCVD_IN_VALIDITY_RPBL RBL: Relay in Validity RPBL,
https://senderscore.org/blocklistlookup/
[85.142.91.171 listed in bl.score.senderscore.com]
-2.0 RCVD_IN_VALIDITY_SAFE RBL: Sender in Validity Safe - Contact
certification@validity.com
[Excessive Number of Queries | <https://knowledge.validity.com/hc/en-us/articles/20961730681243>]
-3.0 RCVD_IN_VALIDITY_CERTIFIED RBL: Sender in Validity Certification -
Contact certification@validity.com
[Excessive Number of Queries | <https://knowledge.validity.com/hc/en-us/articles/20961730681243>]
2.5 RCVD_IN_MSPIKE_L5 RBL: Very bad reputation (-5)
[85.142.91.171 listed in bl.mailspike.net]
0.0 SPF_HELO_NONE SPF: HELO does not publish an SPF Record
-0.0 SPF_PASS SPF: sender matches SPF record
-0.1 DKIM_VALID_EF Message has a valid DKIM or DK signature from
envelope-from domain
0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid
-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature
-0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's
domain
0.0 RCVD_IN_MSPIKE_BL Mailspike blocklisted
-1.9 BAYES_00 BODY: Bayes spam probability is 0 to 1%
[score: 0.0000]
0.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts
0.8 MPART_ALT_DIFF BODY: HTML and text parts are different
0.0 HTML_MESSAGE BODY: HTML included in message
0.8 RDNS_NONE Delivered to internal network by a host with no rDNS
0.1 MIME_HEADER_CTYPE_ONLY 'Content-Type' found without required MIME
headers
0.0 MIME_HTML_ONLY_MULTI Multipart message only has text/html MIME parts
-0.0 DMARC_PASS DMARC pass policy
X-Spam-Flag: NO
Top
Post Reply Previous topic Next topic

Return to “Phishing Scams”