Surge in IRD-Themed Phishing Emails Targeting New Zealand Businesses

We have observed another surge in Inland Revenue (IRD)-themed phishing emails targeting New Zealand businesses, with this latest campaign appearing to originate from compromised email domains rather than newly registered or obviously suspicious sender addresses.

The campaign uses a multi-stage delivery process, including URL fingerprinting to check whether a recipient has previously accessed a link before progressing through the redirect chain. The infrastructure ultimately passes users through qrcodedynamic.com before redirecting them to the actual New Zealand IRD website.

The campaign also uses several phishing domains designed to impersonate myIR and Inland Revenue, with email subjects referencing tax refunds, payment confirmations, secure logins and outstanding account actions.

The use of compromised sender domains makes these messages particularly concerning, as they may bypass some traditional email security controls and appear more legitimate to recipients.

Recommended Mitigations

Organisations should consider blocking the identified phishing, fingerprinting and redirect domains across their email security, DNS filtering and web proxy controls, where possible and without disrupting legitimate business operations.

Security teams should also review email logs for messages containing the listed subjects and URLs, investigate any users who have accessed the phishing links, and consider whether credentials may have been submitted.

Indicators of Compromise (IOCs)

Type	Value	Comment
Domain	delivery.xeersoft.com	User fingerprinting
Domain	vq22rfjm.r.ap-south-1.awstrack.me	LoLS site
Domain	hotm.io	Phishing site
Domain	qrcodedynamic.com	Redirect site
Domain	ird.myirdnz.com	Phishing domain
Domain	inlandrevenue.myirdnz.com	Phishing domain
Email subject	IRD Refund Status (IRD-1G993)
Email subject	Inland Revenue - Secure Login #P-20261030-08505
Email subject	Action Required: myIR Payment Confirmation #P-20261030-02984
Email subject	IRD Notification #P-20261030-08773 - Verify Details
Email subject	New letter from Inland Revenue
Email subject	Notice: Tax Refund Confirmation and Processing Status Update
Email subject	No-reply
Email subject	Your tax refund is waiting
Email subject	Your tax summary is available
Email subject	Important: Verify your myIR account
Email subject	Validate your information
Email subject	myIR Notice #P-20261030-02170 - Payment Required
URL	hxxps://qrcodedynamic[.]com/dk/?utm_campaign=Nouvel+e-mail&utm_medium=email&utm_source=monday	Sample redirect URL
URL	hxxps://hotm[.]io/7A7C71
URL	hxxps://ird[.]myirdnz[.]com/eru/	Phishing URL

Note: URLs have been defanged to reduce the risk of accidental access.

IRD-themed phishing remains an effective lure because businesses and individuals regularly expect tax correspondence, refunds and payment notifications. Organisations should remain alert to unexpected myIR notifications, particularly those requesting account verification or payment-related actions.