# IRS official website: the real address > IRS's real sign-in page is on www.irs.gov. How to tell a fake IRS link from the real one, with examples from 787 live phishing URLs. Canonical: https://www.phishclean.com/official-domains/irs Last updated: 2026-11-09 IRS's real sign-in page is on www.irs.gov. If a link takes you anywhere else and asks for your IRS password, close it. We opened each address below on 9 November 2026. www.irs.gov Your IRS online account starts at irs.gov/your-account ## Domains IRS uses Not a complete list. Each address below can have subdomains in front of it (`www.`, `login.`), and they are still IRS's. - `irs.gov` ## How to read the address Look at the part between `https://` and the first single `/`. Read it from the right. The real thing ends in `irs.gov`, with nothing but a dot before it. - `https://login.irs.gov/…` is IRS: it ends in `.irs.gov`. - `https://irs.gov.account-check.example/…` is not: it ends in `account-check.example`, and IRS's name at the front is decoration. - `https://irs-secure-login.example/…` is not: a hyphen makes a different domain, and anyone can register one. Everything after the first `/` is chosen by whoever made the page, so `…/irs.gov/signin` in the path proves nothing. ## What fake IRS pages looked like On 5 November 2026, PhishTank listed 787 live, verified phishing URLs that its volunteers labelled IRS. - **93.8%** used HTTPS. The padlock means the connection is encrypted, not that the site is IRS. - **1.1%** had "irs" in the hostname. Most fakes give no such clue, so the absence of IRS's name doesn't make a link safe either. - **48.8%** sat on services anyone can sign up to, such as website builders, file sharing and QR-code links, rather than on a domain the attacker registered. Hostnames from the same list that use IRS's name without being IRS's, newest first. Dots are written as `[.]` so none of them is a working link. - irs[.]getdigitalassetcompliance[.]com - irs[.]denhamworks[.]click - irs[.]mydigitalassetcompliance[.]com - irs[.]digitalasset-platform[.]com - irs[.]digitalcomplianceportal[.]com - irs-internal-prototypes[.]com ## Report a fake IRS email or page Send the email to phishing@irs.gov with "IRS" in the subject line, without replying or clicking anything first. Source: [IRS: Report phishing and online scams](https://www.irs.gov/privacy-disclosure/report-phishing), checked 9 November 2026. ## Lures to watch for - The real IRS site ends in .gov, which only US government bodies can register. irs-refund.com or irs.tax-help.net is not the IRS. - Refund and "tax debt" texts with a link are the usual lures. The IRS starts most contact by post. Not sure about a link? Paste it into the [free link checker](https://www.phishclean.com/check-link). It reads the address only and doesn't open the page. The [PhishClean browser extension](https://www.phishclean.com/) also checks each page you open for signs of a fake sign-in form. ## Questions ### What is IRS's official website? www.irs.gov (Your IRS online account starts at irs.gov/your-account). A real IRS address ends in irs.gov, read from the right of the hostname. ### How do I report a fake IRS email or website? Send the email to phishing@irs.gov with "IRS" in the subject line, without replying or clicking anything first. ### Do fake IRS sites use IRS's name in the address? In PhishTank's list of live phishing URLs on 5 November 2026, 9 of the 787 URLs labelled IRS (1.1%) had the brand's name in the hostname, so most gave no such clue. 93.8% used HTTPS, so a padlock proves nothing. ## How we checked - **Sign-in addresses:** opened on 9 November 2026 and followed through every redirect to where the sign-in page loads. - **Phishing numbers:** [PhishTank](https://phishtank.org/)'s online-valid list, downloaded 5 November 2026. Only URLs its volunteers labelled IRS count, and many fakes are labelled "Other", so these are a sample. We didn't open any of them. Data shared under [CC BY-SA 2.5](https://creativecommons.org/licenses/by-sa/2.5/); method as in our [phishing URL statistics](https://www.phishclean.com/research/phishing-urls). - **Example hostnames:** hostnames in the whole list that contain "irs" but aren't on IRS's domains, one per domain. See also: [official sign-in addresses of 15 brands](https://www.phishclean.com/official-domains). Last updated: 9 November 2026, when the sign-in addresses were checked.