Return-Path: <takedown-response+81455347@netcraft.com>
Delivered-To: mshostin@s21.hosterpk.com
Received: from s21.hosterpk.com
by s21.hosterpk.com with LMTP
id +5zeI9oHcmlmDSIArcgM2A
(envelope-from <takedown-response+81455347@netcraft.com>)
for <mshostin@s21.hosterpk.com>; Thu, 22 Jan 2026 11:19:54 +0000
Return-path: <takedown-response+81455347@netcraft.com>
Envelope-to: info@ms-hostingladz.com
Delivery-date: Thu, 22 Jan 2026 11:19:54 +0000
Received: from mail-1c.netcraft.com ([52.31.138.216]:33933)
by s21.hosterpk.com with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384
(Exim 4.99.1)
(envelope-from <takedown-response+81455347@netcraft.com>)
id 1visjE-00000009MJz-122b
for info@ms-hostingladz.com;
Thu, 22 Jan 2026 11:19:54 +0000
Received: from barb.netcraft.com (unknown [10.9.0.151])
(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)
key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256)
(No client certificate requested)
by mail-1c.netcraft.com (Postfix) with ESMTPS id 652343FF3
for <info@ms-hostingladz.com>; Thu, 22 Jan 2026 11:19:12 +0000 (UTC)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=netcraft.com;
s=default202405-yu9bqteb95aqcfpg; t=1769080752;
h=from:from:reply-to:subject:subject:date:date:message-id:message-id:
to:to:cc:mime-version:mime-version:content-type:content-type:
content-transfer-encoding:content-transfer-encoding;
bh=PdXUHs1N/684PYES/eBtNwRsgleNx9cv75XbwKw1LOI=;
b=vJvvHRz2mitXvO22GvRwwrLEyyR9tlQICOulLxU7svp3/Da6jPlx7uArvQ3K/Swp/Q2WUl
eBgZ8wCvygyJTnUdDeNresbBW8Cf6CR2xGQOxykIEhtv99Xn2FNcCTv5hVM9cavl0iHioP
aCIJs5N11y8FfkXAim4kKfVQH38JHLBdezVv6wNatZmws/nEX0DrKv2qN+ppmzWjTQ8QzS
YNWbJaF/6LMTbjWvMB+jnALqcvPgBVdKUA6l9lRC5QXEweKy31k/Ia0rhRg2ZkpJj51SCF
aTkSlUT5XFb3JUycDU+8whnDdrQx0EiBuCw5/VRP6AvrC+AR/yMKX7epRi8aEg==
Received: by barb.netcraft.com (Postfix, from userid 507)
id 6232DB4E; Thu, 22 Jan 2026 11:19:12 +0000 (UTC)
Content-Transfer-Encoding: 8bit
Content-Type: multipart/report; boundary="_----------=_17690807522462421626"; report-type="feedback-report"
MIME-Version: 1.0
Date: Thu, 22 Jan 2026 11:19:12 +0000
From: Netcraft Takedown Service <takedown-response+81455347@netcraft.com>
Subject: Issue 81455347: Phishing attack at hxxps://verify.netflix.ms-hostingladz[.]com/allo/carte2.html
To: info@ms-hostingladz.com
Message-Id: <71b4d482797661ad05cf213a81d4c96d@takedown.netcraft.com>
X-Mailer: MIME::Lite 3.030 (F2.85; T2.17; A2.20; B3.15; Q3.13)
X-Spam-Status: No, score=3.7
X-Spam-Score: 37
X-Spam-Bar: +++
X-Ham-Report: Spam detection software, running on the system "s21.hosterpk.com",
has NOT identified this incoming email as spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
root\@localhost for details.
Content preview: _____ __ __ __ __ ___ ___ __ ____
___ ____ ____ ______ ___ __: hxxps://verify.netflix.ms-hostingladz[.]com/allo/carte2.html
[64.31.22.34]
Content analysis details: (3.7 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
0.0 RCVD_IN_VALIDITY_CERTIFIED_BLOCKED RBL: ADMINISTRATOR NOTICE: The
query to Validity was blocked. See
https://knowledge.validity.com/hc/en-us/articles/20961730681243
for more information.
[52.31.138.216 listed in sa-trusted.bondedsender.org]
6.2 RCVD_IN_MSPIKE_L5 RBL: Very bad reputation (-5)
[52.31.138.216 listed in bl.mailspike.net]
0.0 RCVD_IN_ZEN_BLOCKED_OPENDNS RBL: ADMINISTRATOR NOTICE: The query to
zen.spamhaus.org was blocked due to usage of an
open resolver. See
https://www.spamhaus.org/returnc/pub/
[52.31.138.216 listed in zen.spamhaus.org]
0.0 RCVD_IN_VALIDITY_RPBL_BLOCKED RBL: ADMINISTRATOR NOTICE: The query to
Validity was blocked. See
https://knowledge.validity.com/hc/en-us/articles/20961730681243
for more information.
[52.31.138.216 listed in bl.score.senderscore.com]
-2.3 RCVD_IN_DNSWL_MED RBL: Sender listed at https://www.dnswl.org/,
medium trust
[52.31.138.216 listed in list.dnswl.org]
0.0 RCVD_IN_VALIDITY_SAFE_BLOCKED RBL: ADMINISTRATOR NOTICE: The query to
Validity was blocked. See
https://knowledge.validity.com/hc/en-us/articles/20961730681243
for more information.
[52.31.138.216 listed in sa-accredit.habeas.com]
0.0 URIBL_BLOCKED ADMINISTRATOR NOTICE: The query to URIBL was blocked.
See
http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
for more information.
[URI: netcraft.com]
[URI: xarf.org]
0.0 URIBL_DBL_BLOCKED_OPENDNS ADMINISTRATOR NOTICE: The query to
dbl.spamhaus.org was blocked due to usage of an
open resolver. See
https://www.spamhaus.org/returnc/pub/
[URI: netcraft.com]
[URI: incident.netcraft.com]
[URI: www.xarf.org]
-0.0 SPF_PASS SPF: sender matches SPF record
-0.1 DKIM_VALID_EF Message has a valid DKIM or DK signature from
envelope-from domain
-0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's
domain
-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature
0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid
0.0 RCVD_IN_MSPIKE_BL Mailspike blocklisted
X-Spam-Flag: NO
This is a multi-part message in MIME format.
--_----------=_17690807522462421626
Content-Disposition: inline
Content-Transfer-Encoding: 8bit
Content-Type: text/plain; charset="UTF-8"
ہیلو،
ہم نے آپ کے نیٹ ورک پر واقع ایک فشنگ حملہ دریافت کیا ہے:
hxxps://verify.netflix.ms-hostingladz[.]com/allo/carte2.html [64.31.22.34]
ہو سکتا ہے آپ کو اس حملے کا علم نہ ہو، تاہم، آپ اب بھی اسے ہٹانے کے ذمہ دار ہیں۔
براہ کرم اس دھوکہ دہی پر مبنی مواد، اور اس سے منسلک کسی بھی دوسرے جعلی مواد کو جلد از جلد ہٹا دیں۔
پتہ چلا مسئلہ کے بارے میں مزید معلومات پر فراہم کی گئی ہے۔ https://incident.netcraft.com/reports/ul2knxgcr4g56nc4igamrk
API ﺱپﻭﺭٹ ﺱﻡیﺕ ﻡﺯیﺩ ﺕﻑﺹیﻻﺕ کے ﻝیے https://incident.netcraft.com/about ﺩیکھیں۔
آداب،
Netcraft
فون: +44(0)1225 447500
فیکس: +44(0)1225 448600
نیٹ کرافٹ کا شمارہ نمبر: 81455347
اس حملے سے متعلق اپ ڈیٹس کے بارے میں ہم سے رابطہ کرنے کے لیے، براہ کرم اس ای میل کا جواب دیں۔ براہ کرم نوٹ کریں: اس پتے کے جوابات لاگ کیے جائیں گے، لیکن ہمیشہ پڑھے نہیں جاتے۔ اگر آپ کو لگتا ہے کہ آپ کو یہ ای میل غلطی سے موصول ہوئی ہے، یا آپ کو مزید تعاون کی ضرورت ہے، تو براہ کرم رابطہ کریں: support@netcraft.com۔
اس میل کو x-arf ٹولز سے پارس کیا جا سکتا ہے۔ x-arf کے بارے میں مزید معلومات کے لیے http://www.xarf.org/ پر جائیں۔
-------------------
Hello,
We have discovered a phishing attack on your network.
hxxps://verify.netflix.ms-hostingladz[.]com/allo/carte2.html [64.31.22.34]
You may not have been aware of this attack, however, you are still responsible for removing it.
Please remove this fraudulent content, and any other associated fraudulent content, as soon as possible.
More information about the detected issue is provided at https://incident.netcraft.com/reports/ul2knxgcr4g56nc4igamrk
See https://incident.netcraft.com/about for more details including API support.
Kind regards,
Netcraft
Phone: +44(0)1225 447500
Fax: +44(0)1225 448600
Netcraft Issue Number: 81455347
To contact us about updates regarding this attack, please respond to this email. Please note: replies to this address will be logged, but aren't always read. If you believe you have received this email in error, or you require further support, please contact: support@netcraft.com.
This mail can be parsed with x-arf tools. Visit http://www.xarf.org/ for more information about x-arf.
--_----------=_17690807522462421626
Content-Disposition: inline
Content-Transfer-Encoding: 7bit
Content-Type: message/feedback-report
MIME-Version: 1.0
X-Mailer: MIME::Lite 3.030 (F2.85; T2.17; A2.20; B3.15; Q3.13)
Date: Thu, 22 Jan 2026 11:19:12 +0000
Feedback-Type: xarf
User-Agent: Netcraft
Version: 1
--_----------=_17690807522462421626
Content-Disposition: attachment; filename="xarf.json"
Content-Transfer-Encoding: base64
Content-Type: application/json; charset=utf-8; name="xarf.json"
MIME-Version: 1.0
X-Mailer: MIME::Lite 3.030 (F2.85; T2.17; A2.20; B3.15; Q3.13)
Date: Thu, 22 Jan 2026 11:19:12 +0000
eyJEaXNjbG9zdXJlIjp0cnVlLCJSZXBvcnRlckluZm8iOnsiUmVwb3J0ZXJPcmciOiJOZXRjcmFm
dCIsIlJlcG9ydGVyT3JnRW1haWwiOiJ0YWtlZG93bi1yZXNwb25zZSs4MTQ1NTM0N0BuZXRjcmFm
dC5jb20iLCJSZXBvcnRlck9yZ0RvbWFpbiI6Im5ldGNyYWZ0LmNvbSJ9LCJSZXBvcnQiOnsiUmVw
b3J0ZXJDYXNlSUQiOiI4MTQ1NTM0NyIsIlNvdXJjZVVybCI6Imh0dHBzOi8vdmVyaWZ5Lm5ldGZs
aXgubXMtaG9zdGluZ2xhZHouY29tL2FsbG8vY2FydGUyLmh0bWwiLCJSZXBvcnRDbGFzcyI6IkNv
bnRlbnQiLCJSZXBvcnRlck5vdGVzIjoiU2VlIGh0dHBzOi8vaW5jaWRlbnQubmV0Y3JhZnQuY29t
L3JlcG9ydHMvdWwya254Z2NyNGc1Nm5jNGlnYW1yayBmb3IgbW9yZSBpbmZvcm1hdGlvbiIsIlNv
dXJjZUlwIjoiNjQuMzEuMjIuMzQiLCJGaXJzdFNlZW4iOiIyMDI2LTAxLTIyVDExOjE4OjMwWiIs
IlJlcG9ydFR5cGUiOiJQaGlzaGluZyIsIkRhdGUiOiIyMDI2LTAxLTIyVDExOjE4OjU2WiJ9LCJW
ZXJzaW9uIjoiMSJ9
--_----------=_17690807522462421626--