Return-Path: <takedown-response+81455347@netcraft.com>
Delivered-To: mshostin@s21.hosterpk.com
Received: from s21.hosterpk.com
by s21.hosterpk.com with LMTP
id +mxsF9oHcmleDSIArcgM2A
(envelope-from <takedown-response+81455347@netcraft.com>)
for <mshostin@s21.hosterpk.com>; Thu, 22 Jan 2026 11:19:54 +0000
Return-path: <takedown-response+81455347@netcraft.com>
Envelope-to: support@ms-hostingladz.com
Delivery-date: Thu, 22 Jan 2026 11:19:54 +0000
Received: from mail-1c.netcraft.com ([52.31.138.216]:53113)
by s21.hosterpk.com with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384
(Exim 4.99.1)
(envelope-from <takedown-response+81455347@netcraft.com>)
id 1visjD-00000009MJt-2jUo
for support@ms-hostingladz.com;
Thu, 22 Jan 2026 11:19:54 +0000
Received: from barb.netcraft.com (unknown [10.9.0.151])
(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)
key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256)
(No client certificate requested)
by mail-1c.netcraft.com (Postfix) with ESMTPS id AF25838B6
for <support@ms-hostingladz.com>; Thu, 22 Jan 2026 11:19:11 +0000 (UTC)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=netcraft.com;
s=default202405-yu9bqteb95aqcfpg; t=1769080751;
h=from:from:reply-to:subject:subject:date:date:message-id:message-id:
to:to:cc:mime-version:mime-version:content-type:content-type:
content-transfer-encoding:content-transfer-encoding;
bh=g9jOL7Zz1ZRfE2uPXCzF52MQuc14tbmQI5UoNOKHLlA=;
b=NqMQDZODM1oXOfQ1Q9q96foIUYoLcmf3CyW6hKPpvs5UFDrbD4V79/iDOPd0ocQ5K7xHfz
xjDQ6bMQ+7Da2nzor5uSXc1iLPJTjfoljT0pQxVq0K2UYnWtG5lomon8Bh84wjlS0kDZ01
ShZFGshXiEW4CTrXBQuOOnhECh1ZCL48hGW8J2bFl0XwENDe++sMZlk1dKi/VfhQcEfGPF
zL426km5FegTg7OlQQ/DwJwD95fcM/Sxw2BoFIwefZYWnG773voDMb1hpW1X0qFNRN8ZEy
tQ8L4sVGeY0fjOd4KAMYIGeAqbMkfaEmkeWvEcskk7wQ7aX7CgSJIBe6j/q3Cw==
Received: by barb.netcraft.com (Postfix, from userid 507)
id AC0CAB4E; Thu, 22 Jan 2026 11:19:11 +0000 (UTC)
Content-Transfer-Encoding: 8bit
Content-Type: multipart/report; boundary="_----------=_17690807512462421624"; report-type="feedback-report"
MIME-Version: 1.0
Date: Thu, 22 Jan 2026 11:19:11 +0000
From: Netcraft Takedown Service <takedown-response+81455347@netcraft.com>
Subject: Issue 81455347: Phishing attack at hxxps://verify.netflix.ms-hostingladz[.]com/allo/carte2.html
To: support@ms-hostingladz.com
Message-Id: <ebea831e53665f9827ffc59b1f106b83@takedown.netcraft.com>
X-Mailer: MIME::Lite 3.030 (F2.85; T2.17; A2.20; B3.15; Q3.13)
X-Spam-Status: No, score=3.7
X-Spam-Score: 37
X-Spam-Bar: +++
X-Ham-Report: Spam detection software, running on the system "s21.hosterpk.com",
has NOT identified this incoming email as spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
root\@localhost for details.
Content preview: _____ __ __ __ __ ___ ___ __ ____
___ ____ ____ ______ ___ __: hxxps://verify.netflix.ms-hostingladz[.]com/allo/carte2.html
[64.31.22.34]
Content analysis details: (3.7 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
6.2 RCVD_IN_MSPIKE_L5 RBL: Very bad reputation (-5)
[52.31.138.216 listed in bl.mailspike.net]
0.0 RCVD_IN_ZEN_BLOCKED_OPENDNS RBL: ADMINISTRATOR NOTICE: The query to
zen.spamhaus.org was blocked due to usage of an
open resolver. See
https://www.spamhaus.org/returnc/pub/
[52.31.138.216 listed in zen.spamhaus.org]
-2.3 RCVD_IN_DNSWL_MED RBL: Sender listed at https://www.dnswl.org/,
medium trust
[52.31.138.216 listed in list.dnswl.org]
0.0 URIBL_BLOCKED ADMINISTRATOR NOTICE: The query to URIBL was blocked.
See
http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
for more information.
[URI: netcraft.com]
[URI: xarf.org]
0.0 URIBL_DBL_BLOCKED_OPENDNS ADMINISTRATOR NOTICE: The query to
dbl.spamhaus.org was blocked due to usage of an
open resolver. See
https://www.spamhaus.org/returnc/pub/
[URI: incident.netcraft.com]
[URI: netcraft.com]
[URI: www.xarf.org]
0.0 RCVD_IN_VALIDITY_CERTIFIED_BLOCKED RBL: ADMINISTRATOR NOTICE: The
query to Validity was blocked. See
https://knowledge.validity.com/hc/en-us/articles/20961730681243
for more information.
[52.31.138.216 listed in sa-trusted.bondedsender.org]
0.0 RCVD_IN_VALIDITY_SAFE_BLOCKED RBL: ADMINISTRATOR NOTICE: The query to
Validity was blocked. See
https://knowledge.validity.com/hc/en-us/articles/20961730681243
for more information.
[52.31.138.216 listed in sa-accredit.habeas.com]
0.0 RCVD_IN_VALIDITY_RPBL_BLOCKED RBL: ADMINISTRATOR NOTICE: The query to
Validity was blocked. See
https://knowledge.validity.com/hc/en-us/articles/20961730681243
for more information.
[52.31.138.216 listed in bl.score.senderscore.com]
-0.0 SPF_PASS SPF: sender matches SPF record
-0.1 DKIM_VALID_EF Message has a valid DKIM or DK signature from
envelope-from domain
-0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's
domain
-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature
0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid
0.0 RCVD_IN_MSPIKE_BL Mailspike blocklisted
X-Spam-Flag: NO
This is a multi-part message in MIME format.
--_----------=_17690807512462421624
Content-Disposition: inline
Content-Transfer-Encoding: 8bit
Content-Type: text/plain; charset="UTF-8"
ہیلو،
ہم نے آپ کے نیٹ ورک پر واقع ایک فشنگ حملہ دریافت کیا ہے:
hxxps://verify.netflix.ms-hostingladz[.]com/allo/carte2.html [64.31.22.34]
ہو سکتا ہے آپ کو اس حملے کا علم نہ ہو، تاہم، آپ اب بھی اسے ہٹانے کے ذمہ دار ہیں۔
براہ کرم اس دھوکہ دہی پر مبنی مواد، اور اس سے منسلک کسی بھی دوسرے جعلی مواد کو جلد از جلد ہٹا دیں۔
پتہ چلا مسئلہ کے بارے میں مزید معلومات پر فراہم کی گئی ہے۔ https://incident.netcraft.com/reports/ul2knxgcr4g56nc4igamrk
API ﺱپﻭﺭٹ ﺱﻡیﺕ ﻡﺯیﺩ ﺕﻑﺹیﻻﺕ کے ﻝیے https://incident.netcraft.com/about ﺩیکھیں۔
آداب،
Netcraft
فون: +44(0)1225 447500
فیکس: +44(0)1225 448600
نیٹ کرافٹ کا شمارہ نمبر: 81455347
اس حملے سے متعلق اپ ڈیٹس کے بارے میں ہم سے رابطہ کرنے کے لیے، براہ کرم اس ای میل کا جواب دیں۔ براہ کرم نوٹ کریں: اس پتے کے جوابات لاگ کیے جائیں گے، لیکن ہمیشہ پڑھے نہیں جاتے۔ اگر آپ کو لگتا ہے کہ آپ کو یہ ای میل غلطی سے موصول ہوئی ہے، یا آپ کو مزید تعاون کی ضرورت ہے، تو براہ کرم رابطہ کریں: support@netcraft.com۔
اس میل کو x-arf ٹولز سے پارس کیا جا سکتا ہے۔ x-arf کے بارے میں مزید معلومات کے لیے http://www.xarf.org/ پر جائیں۔
-------------------
Hello,
We have discovered a phishing attack on your network.
hxxps://verify.netflix.ms-hostingladz[.]com/allo/carte2.html [64.31.22.34]
You may not have been aware of this attack, however, you are still responsible for removing it.
Please remove this fraudulent content, and any other associated fraudulent content, as soon as possible.
More information about the detected issue is provided at https://incident.netcraft.com/reports/ul2knxgcr4g56nc4igamrk
See https://incident.netcraft.com/about for more details including API support.
Kind regards,
Netcraft
Phone: +44(0)1225 447500
Fax: +44(0)1225 448600
Netcraft Issue Number: 81455347
To contact us about updates regarding this attack, please respond to this email. Please note: replies to this address will be logged, but aren't always read. If you believe you have received this email in error, or you require further support, please contact: support@netcraft.com.
This mail can be parsed with x-arf tools. Visit http://www.xarf.org/ for more information about x-arf.
--_----------=_17690807512462421624
Content-Disposition: inline
Content-Transfer-Encoding: 7bit
Content-Type: message/feedback-report
MIME-Version: 1.0
X-Mailer: MIME::Lite 3.030 (F2.85; T2.17; A2.20; B3.15; Q3.13)
Date: Thu, 22 Jan 2026 11:19:11 +0000
Feedback-Type: xarf
User-Agent: Netcraft
Version: 1
--_----------=_17690807512462421624
Content-Disposition: attachment; filename="xarf.json"
Content-Transfer-Encoding: base64
Content-Type: application/json; charset=utf-8; name="xarf.json"
MIME-Version: 1.0
X-Mailer: MIME::Lite 3.030 (F2.85; T2.17; A2.20; B3.15; Q3.13)
Date: Thu, 22 Jan 2026 11:19:11 +0000
eyJWZXJzaW9uIjoiMSIsIlJlcG9ydCI6eyJGaXJzdFNlZW4iOiIyMDI2LTAxLTIyVDExOjE4OjMw
WiIsIlJlcG9ydFR5cGUiOiJQaGlzaGluZyIsIkRhdGUiOiIyMDI2LTAxLTIyVDExOjE4OjU2WiIs
IlNvdXJjZVVybCI6Imh0dHBzOi8vdmVyaWZ5Lm5ldGZsaXgubXMtaG9zdGluZ2xhZHouY29tL2Fs
bG8vY2FydGUyLmh0bWwiLCJSZXBvcnRlckNhc2VJRCI6IjgxNDU1MzQ3IiwiUmVwb3J0Q2xhc3Mi
OiJDb250ZW50IiwiUmVwb3J0ZXJOb3RlcyI6IlNlZSBodHRwczovL2luY2lkZW50Lm5ldGNyYWZ0
LmNvbS9yZXBvcnRzL3VsMmtueGdjcjRnNTZuYzRpZ2FtcmsgZm9yIG1vcmUgaW5mb3JtYXRpb24i
LCJTb3VyY2VJcCI6IjY0LjMxLjIyLjM0In0sIlJlcG9ydGVySW5mbyI6eyJSZXBvcnRlck9yZ0Rv
bWFpbiI6Im5ldGNyYWZ0LmNvbSIsIlJlcG9ydGVyT3JnRW1haWwiOiJ0YWtlZG93bi1yZXNwb25z
ZSs4MTQ1NTM0N0BuZXRjcmFmdC5jb20iLCJSZXBvcnRlck9yZyI6Ik5ldGNyYWZ0In0sIkRpc2Ns
b3N1cmUiOnRydWV9
--_----------=_17690807512462421624--