Fake Income Tax Department penalty notice (India) pushing malware downloads — page content

Pages posing as India's Income Tax Department (Ministry of Finance) that show a bilingual Hindi/English 'Office Memorandum' — a 'Tax Compliance Deficiency and Penalty Notice' citing Sections 271(1)(c) and 276C, a 72-hour deadline and a signature from an invented Assistant Commissioner — and push a 'documents' download to desktop visitors. The download is an archive or disk image (ZIP with a double-extension .exe.exe and a side-loaded DLL, or .VHD/.IMG/.RAR) that installs malware; phones get a 'please open on a computer' message instead. The pages run on short-lived, randomly named domains across many TLDs (e.g. pldnf[.]top, ckrotbin[.]biz, gov-xnui[.]com, xjxfxn[.]com, hcgxt[.]com, novazon[.]sbs, bytepulse[.]mom, nexcore[.]help), mostly behind Cloudflare, since at least August 2026. The Income Tax Department does not send penalty notices through such sites; genuine notices are available only after signing in at incometax.gov.in.