IRS official website: the real address

IRS's real sign-in page is on www.irs.gov. If a link takes you anywhere else and asks for your IRS password, close it. We opened each address below on 9 November 2026.

Domains IRS uses

Not a complete list. Each address below can have subdomains in front of it (www., login.), and they are still IRS's.

• irs.gov

How to read the address

Look at the part between https:// and the first single /. Read it from the right. The real thing ends in irs.gov, with nothing but a dot before it.

• https://login.irs.gov/… is IRS: it ends in .irs.gov.
• https://irs.gov.account-check.example/… is not: it ends in account-check.example, and IRS's name at the front is decoration.
• https://irs-secure-login.example/… is not: a hyphen makes a different domain, and anyone can register one.

Everything after the first / is chosen by whoever made the page, so …/irs.gov/signin in the path proves nothing.

What fake IRS pages looked like

On 5 November 2026, PhishTank listed 787 live, verified phishing URLs that its volunteers labelled IRS.

• 93.8% used HTTPS. The padlock means the connection is encrypted, not that the site is IRS.
• 1.1% had "irs" in the hostname. Most fakes give no such clue, so the absence of IRS's name doesn't make a link safe either.
• 48.8% sat on services anyone can sign up to, such as website builders, file sharing and QR-code links, rather than on a domain the attacker registered.

Hostnames from the same list that use IRS's name without being IRS's, newest first. Dots are written as [.] so none of them is a working link.

• irs[.]getdigitalassetcompliance[.]com
• irs[.]denhamworks[.]click
• irs[.]mydigitalassetcompliance[.]com
• irs[.]digitalasset-platform[.]com
• irs[.]digitalcomplianceportal[.]com
• irs-internal-prototypes[.]com

Report a fake IRS email or page

Send the email to phishing@irs.gov with "IRS" in the subject line, without replying or clicking anything first.

Source: IRS: Report phishing and online scams, checked 9 November 2026.

Lures to watch for

• The real IRS site ends in .gov, which only US government bodies can register. irs-refund.com or irs.tax-help.net is not the IRS.
• Refund and "tax debt" texts with a link are the usual lures. The IRS starts most contact by post.

Questions

What is IRS's official website?

www.irs.gov (Your IRS online account starts at irs.gov/your-account). A real IRS address ends in irs.gov, read from the right of the hostname.

How do I report a fake IRS email or website?

Send the email to phishing@irs.gov with "IRS" in the subject line, without replying or clicking anything first.

Do fake IRS sites use IRS's name in the address?

In PhishTank's list of live phishing URLs on 5 November 2026, 9 of the 787 URLs labelled IRS (1.1%) had the brand's name in the hostname, so most gave no such clue. 93.8% used HTTPS, so a padlock proves nothing.

How we checked

• Sign-in addresses: opened on 9 November 2026 and followed through every redirect to where the sign-in page loads.
• Phishing numbers: PhishTank's online-valid list, downloaded 5 November 2026. Only URLs its volunteers labelled IRS count, and many fakes are labelled "Other", so these are a sample. We didn't open any of them. Data shared under CC BY-SA 2.5; method as in our phishing URL statistics.
• Example hostnames: hostnames in the whole list that contain "irs" but aren't on IRS's domains, one per domain.

See also: official sign-in addresses of 15 brands.

Last updated: 9 November 2026, when the sign-in addresses were checked.