Skip to main content

Phishing: Notice from Tax Departmen | Fake Court Notice Resent With the Same Case Number and a Hearing Already Past

· 20 min read
Jagdish Kumawat
Jagdish Kumawat
Founder @ Dewiride

At a glance

Verdict
PhishingGet the recipient, or the finance team it is forwarded to, to open the 'Related Documents' link and run whatever it downloads.
Subject line
Notice from Tax Departmen
Claimed sender
court notice maynardreingertlph@outlook.com
Impersonates
Income Tax Department (India) — Income Tax Department, Government of India, as investigating authority on a court notice for a tax/financial dispute at 'New Delhi Court Complex'
Received
· Published
Known variants

The subject is truncated as received, ending on 'Departmen'. Display name as reported by the recipient; the screenshot shows only the address. The recipient address was blurred.

Evidence: the message as received plus passive registry lookups; links and attachments are not opened. How we analyse a scam email.

COURT NOTICE. Case Number: [ITD/2026/ND/458721]. Hearing Date: September 17, 2026. Time: 10:30 AM. The 4 September court notice sent again from a new Outlook mailbox — its case number unchanged, its link moved to a domain that its registrar has since put on hold, and its hearing set for a time that had passed two and a half hours before the email arrived.

Complete Email​

from: court notice maynardreingertlph@outlook.com
date: 09/17/2026 1:03 PM
subject: Notice from Tax Departmen

The subject line is truncated exactly as shown: it ends on the word "Departmen", without its final letter, as it did on the 4 September copy. The reading pane in the screenshot shows the bare sender address, rendered as MaynardReingertlph@outlook.com; the display name, court notice, is as reported by the recipient. The recipient address is a functional company mailbox; it is blurred in the screenshot and not reproduced here. The External Email line at the foot of the screenshot is the recipient's mail gateway's tag, not part of the message. The message carries one link, which was not followed for this post.

Email Body​

════════════════════════════════════

COURT NOTICE

════════════════════════════════════

Case Number: [ITD/2026/ND/458721]

Case Subject: Tax / Financial Dispute

Investigating Authority: Income Tax Department, Government of India

Hearing Date: September 17, 2026

Time: 10:30 AM

Venue: New Delhi Court Complex, India

Related Documents:

https://scpz6.com

Please share this information internally with the finance department for their reference.

Attacking email screenshot: a plain-text COURT NOTICE from an Outlook address, received at 13:03 on 17 September 2026, giving a hearing at 10:30 AM that same day, with the recipient address blurred

Red Flags​

This is government-impersonation phishing, and the message is not new. It is the court-notice template this archive has now received four times: in English with Portuguese still in it on 10 August, in Hindi on 2 September, in clean English on 4 September, and now the 4 September text again, thirteen days later, with its sender, its hearing date and its link replaced. It arrived four hours and fifty-two minutes after the campaign's other template, the penalty notice, reached the same organisation in its newest form, a CPC Bengaluru intimation: both of the campaign's lures on one day.

The notice's anatomy was taken apart in those posts and has not changed; it is summarised in flag 5. What is new is what a resend reveals — about the parts that changed, and about the one part that did not. Everything below comes from the message, the 4 September copy, and the public registry records.

1. The Hearing Was Over Before the Notice Arrived​

  • Hearing Date: September 17, 2026 — Time: 10:30 AM
  • Received: Thursday, 17 September 2026, at 13:03

The notice arrived two hours and thirty-three minutes after the hearing it announces was due to begin. It summons its reader to nothing. By the time it could be read, the only thing it could report was a court appearance already missed.

A summons exists to get someone to court, and the date on it is chosen for that purpose. India's Code of Civil Procedure states the rule outright: the day of appearance is fixed with regard to the time needed to serve the summons, and "so as to allow the defendant sufficient time to enable him to appear and answer on such day" (Order V, Rule 6). Hearings are set weeks ahead so that the person summoned can receive the notice, consult a lawyer and attend. Even had this message arrived at one minute past midnight, it would have given ten and a half hours' notice of a hearing about a dispute it names only as Tax / Financial.

The date is also the line of the notice that nobody holds steady. The hearing has been fifteen days away in the August draft, three working days away in the Hindi draft, and twenty-six days away on 4 September — and now it is two and a half hours in the past. On 4 September this slot read 30 September 2026. On 17 September, when 30 September was still thirteen days off and would have served perfectly well, it was replaced: with a date in the month-first order the August draft used, and with the day of the send itself. Whether the operator typed the day's date or a mailing tool filled the field with it, the message cannot say. What it shows is that nobody compared the hearing with the clock — because, to the sender, the hearing is not an event. It is decoration around the link.

The 4 September copy, with its hearing nearly four weeks out, applied no pressure at all. Taken at face value, this one tells its reader something worse: that they have already failed to appear. The only thing in the message that offers to explain what happened is Related Documents.

2. Thirteen Days Later, the Same Notice — Case Number Included​

Set the two English copies side by side:

Line4 September17 September
Fromcourt notice raheemzediker4652@outlook.comcourt notice maynardreingertlph@outlook.com
ReceivedFriday 4 September, 01:48Thursday 17 September, 13:03
SubjectNotice from Tax Departmenunchanged
Case Number[ITD/2026/ND/458721]unchanged
Case SubjectTax / Financial Disputeunchanged
Investigating AuthorityIncome Tax Department, Government of Indiaunchanged
Hearing Date30 September 2026September 17, 2026
Time10:30 AMunchanged
VenueNew Delhi Court Complex, Indiaunchanged
Related Documentshttps://dsolvefat.com, run on to the label without a spacehttps://scpz6.com, on a line of its own
ClosingPlease share this information internally with the finance department for their reference.unchanged

Nine of the body's eleven lines read exactly as they did on 4 September, box rules included. What changed are the parts of the message that wear out: the sending mailbox, which is typically reported and closed after a wave; the link, whose domain is typically reported and suspended; and the hearing date, rewritten for no reason the notice gives. The link has also been moved to a line of its own, tidying the one formatting fault of the 4 September copy, where the address ran straight on from Documents:.

What did not change is the case number. [ITD/2026/ND/458721] — square brackets included — is the same string on both copies. A real court's case number identifies one case, and one case has one next hearing date at a time. These two notices carry the same number and two different hearings, thirteen days apart; neither mentions the other, and the later one moves the hearing earlier and then arrives after it has begun. The number is not a record of a case. It is a fixed line of the template, sent unchanged in both copies, still wearing the placeholder brackets the 4 September post pointed out.

It is still not a CNR, the sixteen-character number that every case in India's district courts and High Courts carries on the e-Courts system, and it is still not a DIN, the Document Identification Number every genuine income-tax communication has had to carry since October 2019.

3. The Same Subject and the Same "court notice" — From the Campaign's Eighth Sender​

  • from: court notice maynardreingertlph@outlook.com
  • Subject: Notice from Tax Departmen

The envelope is the 4 September envelope with a new mailbox inside it. The subject still ends one letter short of Department. Thirteen days on, nobody has noticed or fixed the missing letter, which is what happens to a string that is copied rather than typed: on 4 September the same truncated text was also the filename of the disk image the link served. The display name is still court notice, in lower case — a label, not a signature. No court or department signs itself that way.

The mailbox is the only new part, and it is new every time. This is the eighth notice from this campaign in this archive, and the eighth sending address; none has been used twice. MaynardReingertlph is a first name, a surname and three spare letters, the same recipe as raheemzediker4652 on 4 September and fanniepwkm on 7 September: a name, padded out until the address was free, in the pattern typical of accounts created in bulk. Six of the eight senders have been free outlook.com mailboxes, and two of those were spent on 17 September alone — pzdu83934175@outlook.com for the CPC Bengaluru penalty notice at 08:11, and this one at 13:03.

The Income Tax Department writes from incometax.gov.in, and Indian courts from addresses ending in gov.in or nic.in, names that only government bodies can obtain. A consumer mailbox that anyone can open in a minute is neither, whatever its display name says.

4. scpz6.com: a Two-Year-Old Domain on the Campaign's DNS Service, Now on Hold​

  • Related Documents: https://scpz6.com

A court's related documents would be an order or a complaint, served against a case number through the court's own systems. This is a bare domain again, with no path and no filename: five characters, one of them a digit, with no connection to tax, to courts or to India. Its public records, looked up on 27 September 2026:

  • Registered on 4 October 2024 through Gname.com, a registrar in Singapore — almost two years before the send. Gname also sold rxsi9tm65.com, the domain the Hindi notice of 2 September was sent from, and juhuotv.com, the download link in the CPC Bengaluru notice that arrived earlier the same day. An old registration date is part of what such a domain is worth: security tools commonly treat a domain registered last week as suspect and one registered years ago as ordinary.
  • Its name servers are a.share-dns.com and b.share-dns.net, the same DNS service that juhuotv.com uses, and that dsolvefat.com, the link in the 4 September copy, uses too. Two lures, sent to one organisation on one day, pointed at domains on the same service.
  • The registrant's details are redacted except the country, which is given as India. Registrars do not verify that field, and it says nothing reliable about who controls the domain.
  • It is on hold. The registry lists the domain as clientHold, a status set by the registrar that withdraws a domain from the DNS. Registrars apply it for unpaid fees, failed registrant verification, legal disputes and domains reported for abuse; the record does not say which applies here. It was last changed on 21 September, four days after the send. As of our lookup, scpz6.com does not resolve.
  • Its registration runs out on 4 October 2026.

What the link served on 17 September was not examined, and now cannot be. The same slot on 4 September held dsolvefat.com, whose page offered an Income Tax Department "office memorandum" with a Download Documents button, and served a disk image carrying a signed WeChat executable and the malicious DLL it loads. That link was followed, as a documented exception to this site's method; this one was not, and nothing in this copy shows whether scpz6.com served the same file. What the registry does show is a difference in outcome: scpz6.com was withdrawn within days, while dsolvefat.com is not on hold and, as of the same lookup, still resolves.

5. A Court Notice That No Court Could Send​

The rest of the notice is the text taken apart in the August and 4 September posts, and every structural fault in it has survived another send:

  • A tax department cannot issue a court notice. Courts issue summons in their own name, signed by a judge or a court officer and sealed with the court's seal, naming the case and the court. The Income Tax Department is a party before a court, not the court — and this notice names it as the "Investigating Authority" and names no court at all.
  • "New Delhi Court Complex" is not a court. Delhi's district courts sit at Tis Hazari, Patiala House, Karkardooma, Rohini, Saket, Dwarka and Rouse Avenue, and the High Court at Sher Shah Road. Each has an address, court-room numbers and a daily cause list. This one has a city.
  • It gives no judge, no court room and no instruction. It does not say who is summoned, in what capacity, or what happens to someone who does not come. The only things it asks of its reader are to open the link and to tell the finance department.

6. Nothing About You — and the Same Request to Carry It to Finance​

  • "Please share this information internally with the finance department for their reference."

No name, no company, no PAN, no assessment year, no allegation beyond Tax / Financial Dispute. A notice issued against a company would name the company. This one cannot, because it went to a functional mailbox scraped from a company website, and the sender knows nothing beyond the address. A real income-tax notice appears under e-Proceedings in your own e-Filing account, with a DIN you can authenticate; a real court case appears on ecourts.gov.in, with a CNR you can search. This one exists only in inboxes.

And it closes, as every copy has, by asking to be forwarded to finance. On 4 September that sentence would have carried a disk image to the person with payment authority, tax-portal logins and bank credentials on their machine. It asks the same now. An internal forward strips the External Email tag and delivers the link from a colleague's address, with a colleague's implicit endorsement.

How This Scam Works​

The notice is bait for one click, and the resend shows which parts of the operation are fixed and which are used up. Where this copy's link led on the day was not observed — it was not followed, and it has since gone dark — but the same template's link on 4 September was, and campaigns of this kind typically run like this:

  1. The Template: The court-notice text is the fixed asset. It has been redrafted from language to language since August — English with Portuguese leftovers, then Hindi, then clean English — and on 17 September it was not redrafted at all. Only the sender, the date and the link were filled in afresh.
  2. The Link Domain: Domains for the links are typically bought well in advance and left to age, then switched on for a wave. This one was registered in October 2024, on the same DNS service as the campaign's other link domains, and by 27 September its registrar had put it on hold.
  3. The Mailbox: A fresh free Outlook mailbox is opened for each send, under a generated name, and typically lasts one wave.
  4. The List: Functional company addresses harvested from websites. The notice knows nothing about its recipient, which is why it names nothing. The same organisation is sent both of the campaign's templates, from different mailboxes, sometimes on the same day.
  5. The Click: The target opens the link. On 4 September the page behind it was an Income Tax Department "office memorandum" — the campaign's penalty-notice template — with a file number, a 72-hour deadline, a threat of prosecution and one button. Later links are built to do the same job.
  6. The Download: On 4 September the button served a disk image carrying a renamed, legitimately signed Tencent WeChat executable and an unsigned DLL that the executable loads when it runs. Payloads in campaigns like this are typically rebuilt for each wave, so that a file blocked last week is not the file sent this week.
  7. The Foothold: If the file is run, the attacker's code typically runs inside a trusted, signed process on the machine of the person who handles tax notices — the one with the e-Filing session, the bank portal, and the mailbox that talks to every supplier.
  8. The Next Send: When a link domain is reported and held, the template goes out again with a new one. This copy went out thirteen days after the last, with a new mailbox, a new link and a new date; an operator who has resent a notice once will typically resend it again.

Conclusion and Recommendations​

There is no case ITD/2026/ND/458721, no hearing at 10:30 on 17 September, and no New Delhi Court Complex. There is the 4 September notice sent again from a new throwaway Outlook mailbox, with the same case number, a new link to a two-year-old domain that its registrar has since put on hold, and a hearing date set to a time that had passed before the email arrived.

A resend is more revealing than a new draft. A new draft shows what the attacker chose to improve; a resend shows what the attacker never looks at. Nobody checked the hearing against the clock, nobody noticed that the case number now carried two different hearings, and nobody restored the missing letter in the subject — because none of those lines is meant to be read closely. They are there to make one line look obligatory.

A notice that does not care whether its own hearing has happened was never about the hearing. It was about the link.

Immediate Actions:​

  • Do Not Open the Link, Even Though It Is Dead: scpz6.com does not resolve today, but a registrar hold can be lifted, and the next copy of this notice will carry a new, working link. If the link was opened and something was downloaded, delete it unopened. If anything from it was opened or run, treat the machine as compromised: disconnect it from the network, hand it to IT or security, and from a different device reset every credential it held or used — e-Filing, banking, email — and turn on multi-factor authentication wherever it was not already on.
  • Do Not Forward It, Least of All to Finance: The message asks for exactly this. If finance should know, tell them about the phishing attempt in a fresh message and leave the original where it is.
  • Do Not Reply: A reply confirms a live, human-read mailbox and marks it for the next send.
  • Check the Portals Yourself: Type ecourts.gov.in into a browser and search for cases by your company's name; log in to incometax.gov.in yourself and look under e-Proceedings. A real case or notice is there, with a CNR or a DIN you can check.
  • Find the Other Copies: This subject has now reached one organisation twice, thirteen days apart, from two different senders. Whoever administers your mail can search for the exact subject — typo included, Notice from Tax Departmen — and for outlook.com senders using the display name court notice, and remove every copy before someone else opens one.
  • Report and Delete: Use the mail client's phishing report so the sender reaches your gateway's blocklist. Forward the message to the Income Tax Department at webmanager@incometax.gov.in, with a copy to CERT-In at incident@cert-in.org.in, as the department's own phishing page asks, including the full headers if your mail client can show them. If money or data was lost, report it at cybercrime.gov.in or call the helpline 1930.

Verification Steps:​

  • Check the Date Against the Clock: A summons gives its recipient time to attend; the law requires it to. A notice whose hearing has passed before you can read it is not a summons.
  • Compare It With What You Have Already Received: The same case number on two notices with two different hearing dates is not a case. It is a template. Keep suspect notices, or have IT keep them, so that the next one can be checked against the last.
  • Look Up the Case Where Cases Are Recorded: A real case has a sixteen-character CNR on ecourts.gov.in. [ITD/2026/ND/458721] is not one.
  • Read the Sender's Domain, to the Right of the @: outlook.com is a free consumer mailbox. The Income Tax Department writes from incometax.gov.in, and courts from gov.in and nic.in.
  • Ask Who Is Writing, and in What Capacity: A tax department is a party before a court, never the court. A notice that names the department as its "investigating authority" and names no court is from neither.
  • Verify Through a Route You Already Had: Your chartered accountant, your lawyer, the portal you log into yourself. Never a link, address or number supplied by the message you are trying to check.

Additional Protection Tips​

  • Never "Test" a Link to See Whether It Still Works: A dead link today can be live tomorrow, and a visit hands the operator a visitor to profile — and, if the page is back up, the payload. The safe checks are the ones that never touch the link: the portal, the court's own site, the public registry.
  • Block Disk Images and Archives From Unknown Senders: The payload this template delivered on 4 September was a disk image, and the campaign's other templates have used ZIP files. .img, .iso, .vhd and archives from senders your organisation has never dealt with should be blocked or held for inspection at the gateway, and flagged when downloaded.
  • Learn the Structural Checks, Not the Cosmetic Ones: This notice has been redrafted in English, in Hindi and in English again, then resent, and none of it touched its structure: no CNR, no DIN, no court, no gov.in. Those checks work on every copy, however clean its English.
  • Treat Every Date as Evidence: A hearing already past, a 72-hour deadline, a demand payable in fifteen days — each can be checked against the calendar and the law. A real deadline survives a phone call to your accountant; a fabricated one does not.
  • Route Tax and Legal Correspondence Through One Named Owner: A notice that arrives at a functional mailbox is, by that fact, not from the department, which writes to the address registered against your PAN. One person who verifies every such notice on the portal turns every other channel into a tell.
  • Make "Share This Internally" a Reportable Event: Messages that ask to be circulated use your staff as the transport. Suspicious mail goes to IT or security, never sideways to finance.

Remember: A summons is sent so that someone can come to court. This one arrived after its own hearing, carried a case number it had already used for a different date, and offered nothing but a link. When the details of a notice do not matter to the person who sent it, the details are not the message. The link is.

Share this post