Review of your return found under-reported income and undisclosed foreign assets. Refer to the attachment for full details. A bilingual Income Tax Department notice that says nothing about the tax, the amount, or the taxpayer, and defers to a ZIP file in every other sentence — sent from a domain registered seventeen days earlier, through a real-looking government address pasted into the wrong half of the sender.

COURT NOTICE. Case Number: [ITD/2026/ND/458721]. Investigating Authority: Income Tax Department, Government of India. Hearing Date: 30 September 2026. The court-notice template's fourth draft, back in English and back on a free Outlook mailbox. This time we followed the link to the end: a disk image carrying a signed Tencent WeChat executable and the malicious DLL it loads.

You have been randomly selected to receive a €4,500,000 donation. A Cantonese-language donation fraud signed in the name of a real German research foundation, sent from borrowed mailboxes in Brazil, Ukraine and Indonesia, and routing replies to a misspelled Gmail address.

Court Notice. Case Number: 54973713. Investigating Authority: Income Tax Department, Government of India. Monday, 7 September 2026, 10:30 AM. The Brazilian judicial-notice template we took apart in August, now translated into Hindi with its Portuguese removed and sent from a randomly generated domain instead of a free Outlook mailbox.

This is a official email. We are the Domain Registration Service company in Shanghai, China. The Chinese domain name registration scam, back for the third time in our archive, sent from a nine-month-old domain with the same phone numbers and the same Shanghai address as the version we dissected in June 2024.

The tax inspection of your company has revealed irregularities under Section 271(1)(c) of the Income Tax Act, 1961. The same forged Income Tax Department notice we dissected a month ago, rewritten to remove its worst mistakes and pointed at a convincing lookalike domain registered in Indonesia.

I am MacKenzie Scott, ex-wife of Amazon CEO and founder Jeff Bezos. A Chinese-language donation fraud promising USD 100,800,000 through a foundation that does not exist, sent from a German online shop's info mailbox under a subject line that is only Re:.

We are contacting you regarding your expired domain registration. A WordPress.com-branded final warning sent from a German mail server subdomain, whose only button points at a throwaway subdomain of an Italian sports academy.

Please I'm consulting you for my personal investment plan. An advance-fee approach signed in the name of Ukraine's First Lady, sent from a car dealership's mailbox at a UAE internet provider, asking you to reply to a Gmail address.

You have Two (2) Messages Pending Delivery on Your E-mail Portal. A notice claiming to be your own domain's web administrator, sent from an animal-feed company's accounts mailbox, whose button opens a page the attacker uploaded into a Google Cloud Storage bucket.