Attempts to obtain sensitive information by disguising as trustworthy entities.
View All Tags
COURT NOTICE. Case Number: [ITD/2026/ND/458721]. Hearing Date: September 17, 2026. Time: 10:30 AM. The 4 September court notice sent again from a new Outlook mailbox — its case number unchanged, its link moved to a domain that its registrar has since put on hold, and its hearing set for a time that had passed two and a half hours before the email arrived.
We have paused all upload and sync activities for your account. New data is not being saved. A storage-full alert that never names its provider, sent twice under two different stories — URGENT Renewal attempt failed from Billing Support, and Your account has been disabled from Payment System — from two unrelated business domains, with both of its links parked in a stranger's Google Cloud Storage bucket, and an unsubscribe link that hands you to a three-month-old domain asking you to type in your email address.
Your documents are ready kindly scan the can QR CODE to review and sign. A salary adjustment contract posing as the company's own HR department, sent from the postmaster mailbox of an unrelated domain, styled as DocuSign in the email and OneDrive in the PDF, with the company's name, logo and mailbox merged in — and a QR code as the only way in.
This tax invoice contains proprietary information. Please download the attachment and enter the file password to view it. A GST invoice that masks its supplier, its goods and its bank account, names no buyer, and arrives with a password-protected ZIP — whose password is printed in the email, and again in the attachment's own filename.
Intimation under Section 143(1) of the Income Tax Act, 1961, cross-verified with AIS, TIS, and SFT, with a total corporate demand of ₹ 2,73,250 payable in fifteen days. The penalty-notice template's third draft — sharing its reply-to with the 7 September version — now dressed as a CPC Bengaluru intimation, with a fabricated DIN, a demand table that cites a Section 234F fee at a ceiling that was cut in half four years ago, and a ZIP to download.
Review of your return found under-reported income and undisclosed foreign assets. Refer to the attachment for full details. A bilingual Income Tax Department notice that says nothing about the tax, the amount, or the taxpayer, and defers to a ZIP file in every other sentence — sent from a domain registered seventeen days earlier, through a real-looking government address pasted into the wrong half of the sender.
COURT NOTICE. Case Number: [ITD/2026/ND/458721]. Investigating Authority: Income Tax Department, Government of India. Hearing Date: 30 September 2026. The court-notice template's fourth draft, back in English and back on a free Outlook mailbox. This time we followed the link to the end: a disk image carrying a signed Tencent WeChat executable and the malicious DLL it loads.
Court Notice. Case Number: 54973713. Investigating Authority: Income Tax Department, Government of India. Monday, 7 September 2026, 10:30 AM. The Brazilian judicial-notice template we took apart in August, now translated into Hindi with its Portuguese removed and sent from a randomly generated domain instead of a free Outlook mailbox.
The tax inspection of your company has revealed irregularities under Section 271(1)(c) of the Income Tax Act, 1961. The same forged Income Tax Department notice we dissected a month ago, rewritten to remove its worst mistakes and pointed at a convincing lookalike domain registered in Indonesia.
We are contacting you regarding your expired domain registration. A WordPress.com-branded final warning sent from a German mail server subdomain, whose only button points at a throwaway subdomain of an Italian sports academy.
