/home2/mshostin/mail/new/1775705277.M875430P1023569.s21.hosterpk.com,S=12856,W=13069
Return-Path: <takedown-response+82350791@netcraft.com>
Delivered-To: mshostin@s21.hosterpk.com
Received: from s21.hosterpk.com
	by s21.hosterpk.com with LMTP
	id FOj4M70c12lRng8ArcgM2A
	(envelope-from <takedown-response+82350791@netcraft.com>)
	for <mshostin@s21.hosterpk.com>; Thu, 09 Apr 2026 03:27:57 +0000
Return-path: <takedown-response+82350791@netcraft.com>
Envelope-to: info@ms-hostingladz.com
Delivery-date: Thu, 09 Apr 2026 03:27:57 +0000
Received: from mail-1c.netcraft.com ([52.31.138.216]:41727)
	by s21.hosterpk.com with esmtps  (TLS1.3) tls TLS_AES_256_GCM_SHA384
	(Exim 4.99.1)
	(envelope-from <takedown-response+82350791@netcraft.com>)
	id 1wAg3b-00000004Hbx-0D4q
	for info@ms-hostingladz.com;
	Thu, 09 Apr 2026 03:27:57 +0000
Received: from walleye.netcraft.com (unknown [10.9.0.81])
	(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)
	 key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256)
	(No client certificate requested)
	by mail-1c.netcraft.com (Postfix) with ESMTPS id 970E82203
	for <info@ms-hostingladz.com>; Thu,  9 Apr 2026 03:27:07 +0000 (UTC)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=netcraft.com;
	s=default202405-yu9bqteb95aqcfpg; t=1775705227;
	h=from:from:reply-to:subject:subject:date:date:message-id:message-id:
	 to:to:cc:mime-version:mime-version:content-type:content-type:
	 content-transfer-encoding:content-transfer-encoding;
	bh=SOL30wsk6yN2Fu6QAh11DwEOHP6RVPEUqZGyIsxRiM0=;
	b=Kt2QVMtfJ9Iffbh5ZuC5x5KSyLjwTy58ajuPUDZqfgLr51kDzAyE0z7ovOaWMBPxEETANC
	p8KP35bQ/tQxQMs8+FqqgSDuMpS5GggiI+Yhwdhb+oVjS9qSymsceZPOq9bdD6cHCM9Nja
	9EUHkaDXeka51wG/segyisQjEXTixB74uoVwcTNUcDTXn5Wyw08zf9FqJAN64Ag7dowCDe
	goA7LsBBkzCilJM7tBErUE9ocqyIaN2QvNsQgM/UbG3s+l+GEGWEeKdzk5WShazrE2n1tr
	CQW/D47IjGqqYqTYhXhPFlskuuOf7TqsxVu1gyAYng5W37fRc9w5SwK7vhy2HQ==
Received: by walleye.netcraft.com (Postfix, from userid 507)
	id 93ED51E40; Thu,  9 Apr 2026 03:27:07 +0000 (UTC)
Content-Transfer-Encoding: 8bit
Content-Type: multipart/report; boundary="_----------=_1775705227246351675"; report-type="feedback-report"
MIME-Version: 1.0
Date: Thu, 9 Apr 2026 03:27:07 +0000
From: Netcraft Takedown Service <takedown-response+82350791@netcraft.com>
Subject: Issue 82350791: Malicious web shell at hxxp://mail.ms-hostingladz[.]com/gh/hh.php
To: info@ms-hostingladz.com
Message-Id: <04f2337817fcca76e1e5d27349597b22@takedown.netcraft.com>
X-Mailer: MIME::Lite 3.030 (F2.85; T2.17; A2.20; B3.15; Q3.13)
X-Spam-Status: No, score=-2.5
X-Spam-Score: -24
X-Spam-Bar: --
X-Ham-Report: Spam detection software, running on the system "s21.hosterpk.com",
 has NOT identified this incoming email as spam.  The original
 message has been attached to this so you can view it or label
 similar future email.  If you have any questions, see
 root\@localhost for details.
 Content preview:  _____ __ __ ______ ___ __ __ __ __
    ___ ___ __ ___ ______ __ ____ ___ ___ ____
    ___ __ ___ __: hxxp://mail.ms-hostingladz[.]com/gh/hh.php [64.31.22.34]
    hxxp://recovery.meta.verify.ms-hostingladz[.]com/gh/ [64.31.22.34] hxxps://verify.netflix.ms-hostingladz[.]com/gh/
    [64.31.22.34] hxxps://recove [...] 
 Content analysis details:   (-2.5 points, 5.0 required)
  pts rule name              description
 ---- ---------------------- --------------------------------------------------
  0.0 RCVD_IN_ZEN_BLOCKED_OPENDNS RBL: ADMINISTRATOR NOTICE: The query to
                             zen.spamhaus.org was blocked due to usage of an
                              open resolver. See
                             https://www.spamhaus.org/returnc/pub/
                             [52.31.138.216 listed in zen.spamhaus.org]
  0.0 RCVD_IN_VALIDITY_SAFE_BLOCKED RBL: ADMINISTRATOR NOTICE: The query to
                              Validity was blocked.  See
                             https://knowledge.validity.com/hc/en-us/articles/20961730681243
                              for more information.
                             [52.31.138.216 listed in sa-accredit.habeas.com]
  0.0 RCVD_IN_VALIDITY_RPBL_BLOCKED RBL: ADMINISTRATOR NOTICE: The query to
                              Validity was blocked.  See
                             https://knowledge.validity.com/hc/en-us/articles/20961730681243
                              for more information.
                             [52.31.138.216 listed in bl.score.senderscore.com]
  0.0 RCVD_IN_VALIDITY_CERTIFIED_BLOCKED RBL: ADMINISTRATOR NOTICE: The
                             query to Validity was blocked.  See
                             https://knowledge.validity.com/hc/en-us/articles/20961730681243
                              for more information.
                          [52.31.138.216 listed in sa-trusted.bondedsender.org]
 -2.3 RCVD_IN_DNSWL_MED      RBL: Sender listed at https://www.dnswl.org/,
                             medium trust
                             [52.31.138.216 listed in list.dnswl.org]
  0.0 URIBL_BLOCKED          ADMINISTRATOR NOTICE: The query to URIBL was blocked.
                             See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URI: netcraft.com]
                             [URI: xarf.org]
  0.0 URIBL_DBL_BLOCKED_OPENDNS ADMINISTRATOR NOTICE: The query to
                             dbl.spamhaus.org was blocked due to usage of an
                              open resolver. See
                             https://www.spamhaus.org/returnc/pub/
                             [URI: netcraft.com]
                             [URI: incident.netcraft.com]
                             [URI: www.xarf.org]
 -0.0 SPF_PASS               SPF: sender matches SPF record
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -0.1 DKIM_VALID_EF          Message has a valid DKIM or DK signature from
                             envelope-from domain
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from author's
                             domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily valid
X-Spam-Flag: NO

This is a multi-part message in MIME format.

--_----------=_1775705227246351675
Content-Disposition: inline
Content-Transfer-Encoding: 8bit
Content-Type: text/plain; charset="UTF-8"

ہیلو،

ہم نے دریافت کیا ہے کہ آپ کے نیٹ ورک پر ایک بدنیتی پر مبنی ویب شیل ہوسٹ کیا جا رہا ہے:

hxxp://mail.ms-hostingladz[.]com/gh/hh.php [64.31.22.34]
hxxp://recovery.meta.verify.ms-hostingladz[.]com/gh/ [64.31.22.34]
hxxps://verify.netflix.ms-hostingladz[.]com/gh/ [64.31.22.34]
hxxps://recovery.meta.verify.ms-hostingladz[.]com/gh/ [64.31.22.34]
hxxps://recovery.meta.verify.ms-hostingladz[.]com/gh/hh.php [64.31.22.34]
hxxps://verify.netflix.ms-hostingladz[.]com/gh/hh.php [64.31.22.34]

ویب شیل اسکرپٹ ہیں جو حملہ آوروں کو ریموٹ رسائی حاصل کرنے کے لیے سمجھوتہ کرنے والے ویب سرورز پر اپ لوڈ کرتے ہیں۔ جب ویب براؤزر کا استعمال کرتے ہوئے رسائی حاصل کی جاتی ہے تو، ویب شیل حملہ آوروں کو فائلیں اپ لوڈ کرنے، سرور پر من مانی احکامات پر عمل درآمد کرنے اور سپیم بھیجنے کی اجازت دے سکتے ہیں۔ ویب شیل اکثر سمجھوتہ شدہ سرور پر فشنگ یا میلویئر اٹیک بنانے کے لیے استعمال ہوتے ہیں۔

حملہ آور اکثر ویب شیل کو سومی صفحات کے طور پر چھپانے کی کوشش کرتے ہیں۔ عام تکنیکوں میں جعلی 404 صفحہ واپس کرنا اور صفحہ پر موجود ویب شیل ان پٹ فیلڈز کو پوشیدہ بنانا شامل ہے۔ براہ کرم چیک کریں کہ حملہ آور اس رپورٹ کو مسترد کرنے سے پہلے ویب شیل کو چھپانے کی کوشش نہیں کر رہا ہے۔

اس مسئلے کے بارے میں ہم نے پہلے آپ سے 2026-02-10 06:52:26 (UTC) پر رابطہ کیا تھا۔
ہماری آخری اطلاع کے بعد سے، درج ذیل اضافی URL(ز) کا پتہ چلا ہے:

hxxp://mail.ms-hostingladz[.]com/gh/hh.php

پتہ چلا مسئلہ کے بارے میں مزید معلومات پر فراہم کی گئی ہے۔ https://incident.netcraft.com/reports/4k37lytsjqhytdlcb5jjuw
API ﺱپﻭﺭٹ ﺱﻡیﺕ ﻡﺯیﺩ ﺕﻑﺹیﻻﺕ کے ﻝیے https://incident.netcraft.com/about ﺩیکھیں۔

آداب،

Netcraft

فون: +44(0)1225 447500
فیکس: +44(0)1225 448600
نیٹ کرافٹ کا شمارہ نمبر: 85568927

اس حملے سے متعلق اپ ڈیٹس کے بارے میں ہم سے رابطہ کرنے کے لیے، براہ کرم اس ای میل کا جواب دیں۔ براہ کرم نوٹ کریں: اس پتے کے جوابات لاگ کیے جائیں گے، لیکن ہمیشہ پڑھے نہیں جاتے۔ اگر آپ کو لگتا ہے کہ آپ کو یہ ای میل غلطی سے موصول ہوئی ہے، یا آپ کو مزید تعاون کی ضرورت ہے، تو براہ کرم رابطہ کریں: support@netcraft.com۔

اس میل کو x-arf ٹولز سے پارس کیا جا سکتا ہے۔ x-arf کے بارے میں مزید معلومات کے لیے http://www.xarf.org/ پر جائیں۔
-------------------
Hello,

We have discovered a malicious web shell being hosted on your network:

hxxp://mail.ms-hostingladz[.]com/gh/hh.php [64.31.22.34]
hxxp://recovery.meta.verify.ms-hostingladz[.]com/gh/ [64.31.22.34]
hxxps://verify.netflix.ms-hostingladz[.]com/gh/ [64.31.22.34]
hxxps://recovery.meta.verify.ms-hostingladz[.]com/gh/ [64.31.22.34]
hxxps://recovery.meta.verify.ms-hostingladz[.]com/gh/hh.php [64.31.22.34]
hxxps://verify.netflix.ms-hostingladz[.]com/gh/hh.php [64.31.22.34]

Web shells are scripts that attackers upload to compromised web-servers in order to gain remote access. When accessed using a web browser, web shells can allow attackers to upload files, execute arbitrary commands on the server, and send spam. Web shells are often used to create phishing or malware attacks on the compromised server.

Attackers often attempt to disguise web shells as benign pages. Common techniques include returning a fake 404 page and making the web shell input fields on the page invisible. Please check the attacker is not attempting to hide the web shell before dismissing this report.

We previously contacted you about this issue on 2026-02-10 06:52:26 (UTC).
Since our last notification, the following additional URL(s) have been detected:

hxxp://mail.ms-hostingladz[.]com/gh/hh.php

More information about the detected issue is provided at https://incident.netcraft.com/reports/4k37lytsjqhytdlcb5jjuw
See https://incident.netcraft.com/about for more details including API support.

Kind regards,

Netcraft

Phone: +44(0)1225 447500
Fax: +44(0)1225 448600
Netcraft Issue Number: 85568927

To contact us about updates regarding this attack, please respond to this email. Please note: replies to this address will be logged, but aren't always read. If you believe you have received this email in error, or you require further support, please contact: support@netcraft.com.

This mail can be parsed with x-arf tools. Visit http://www.xarf.org/ for more information about x-arf.
--_----------=_1775705227246351675
Content-Disposition: inline
Content-Transfer-Encoding: 7bit
Content-Type: message/feedback-report
MIME-Version: 1.0
X-Mailer: MIME::Lite 3.030 (F2.85; T2.17; A2.20; B3.15; Q3.13)
Date: Thu, 9 Apr 2026 03:27:07 +0000

Feedback-Type: xarf
User-Agent: Netcraft
Version: 1
--_----------=_1775705227246351675
Content-Disposition: attachment; filename="xarf.json"
Content-Transfer-Encoding: base64
Content-Type: application/json; charset=utf-8; name="xarf.json"
MIME-Version: 1.0
X-Mailer: MIME::Lite 3.030 (F2.85; T2.17; A2.20; B3.15; Q3.13)
Date: Thu, 9 Apr 2026 03:27:07 +0000

eyJEaXNjbG9zdXJlIjp0cnVlLCJSZXBvcnQiOnsiU291cmNlVXJsIjoiaHR0cDovL21haWwubXMt
aG9zdGluZ2xhZHouY29tL2doL2hoLnBocCIsIlJlcG9ydFR5cGUiOiJNYWx3YXJlIiwiUmVwb3J0
ZXJOb3RlcyI6IlNlZSBodHRwczovL2luY2lkZW50Lm5ldGNyYWZ0LmNvbS9yZXBvcnRzLzRrMzds
eXRzanFoeXRkbGNiNWpqdXcgZm9yIG1vcmUgaW5mb3JtYXRpb24iLCJSZXBvcnRDbGFzcyI6IkNv
bnRlbnQiLCJGaXJzdFNlZW4iOiIyMDI2LTA0LTA5VDAzOjA1OjU2WiIsIlJlcG9ydGVyQ2FzZUlE
IjoiODU1Njg5MjciLCJEYXRlIjoiMjAyNi0wNC0wOVQwMzoyMjozNVoiLCJTb3VyY2VJcCI6IjY0
LjMxLjIyLjM0In0sIlJlcG9ydGVySW5mbyI6eyJSZXBvcnRlck9yZyI6Ik5ldGNyYWZ0IiwiUmVw
b3J0ZXJPcmdFbWFpbCI6InRha2Vkb3duLXJlc3BvbnNlKzgyMzUwNzkxQG5ldGNyYWZ0LmNvbSIs
IlJlcG9ydGVyT3JnRG9tYWluIjoibmV0Y3JhZnQuY29tIn0sIlZlcnNpb24iOiIxIn0=

--_----------=_1775705227246351675--
Path: home2/mshostin/mail/new