????
Your IP : 3.138.134.106
| Current Path : /home/innovagencyco/mail/new/ |
|
|
| Current File : /home/innovagencyco/mail/new/1729044679.M523860P1577568.imr70-cvps01.hostserv.co.za,S=8190,W=8351 |
Return-Path: <takedown-response+62456393@netcraft.com>
Delivered-To: innovagencyco@imr70-cvps01.hostserv.co.za
Received: from imr70-cvps01.hostserv.co.za
by imr70-cvps01.hostserv.co.za with LMTP
id cGrQHccgD2dgEhgA+LLMVA
(envelope-from <takedown-response+62456393@netcraft.com>)
for <innovagencyco@imr70-cvps01.hostserv.co.za>; Wed, 16 Oct 2024 04:11:19 +0200
Return-path: <takedown-response+62456393@netcraft.com>
Envelope-to: info@innovagency.co.za
Delivery-date: Wed, 16 Oct 2024 04:11:19 +0200
Received: from spamtitan-filter03.hostserv.co.za ([41.185.250.30]:28922)
by imr70-cvps01.hostserv.co.za with esmtp (Exim 4.97.1)
(envelope-from <takedown-response+62456393@netcraft.com>)
id 1t0tVP-00000006fS2-2KdF
for info@innovagency.co.za;
Wed, 16 Oct 2024 04:11:19 +0200
Received: from localhost (localhost [127.0.0.1])
by spamtitan-filter03.hostserv.co.za (Postfix) with ESMTP id CECD9266C2B1
for <info@innovagency.co.za>; Wed, 16 Oct 2024 04:11:18 +0200 (SAST)
X-Quarantine-ID: <Is8U1oa1zAIs>
X-Virus-Scanned: by SpamTitan at hostserv.co.za
X-Spam-Flag: NO
X-Spam-Score: 1.71
X-Spam-Level: *
X-Spam-Status: No, score=1.71 tagged_above=-999 required=5
tests=[ANY_BOUNCE_MESSAGE=0.1, BOUNCE_MESSAGE=0.1, DKIM_SIGNED=0.1,
DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1,
DNSWL_DWL_MED=-0.2, KAM_SHORT=0.001, RCVD_IN_DNSWL_BLOCKED=0.001,
RCVD_IN_MSPIKE_H2=-0.001, RCVD_IN_SPFWL=-0.2,
RCVD_IN_VALIDITY_CERTIFIED_BLOCKED=0.001,
RCVD_IN_VALIDITY_RPBL_BLOCKED=0.001, SPF_HELO_NONE=0.001,
SPF_PASS=-0.001, ST_KGM_OBFUSCATE_1=0.4, ST_KGM_OBFUSCATE_2=0.8,
ST_LONG_ENVELOPE_FROM=0.906, URIBL_BLOCKED=0.001] autolearn=disabled
Received: from spamtitan-filter03.hostserv.co.za (localhost [127.0.0.1])
by spamtitan-filter03.hostserv.co.za (Postfix) with ESMTP id 7DFAE266C11A
for <info@innovagency.co.za>; Wed, 16 Oct 2024 04:11:14 +0200 (SAST)
Authentication-Results: spamtitan-filter03.hostserv.co.za;
dkim=pass (2048-bit rsa key sha256) header.d=netcraft.com
header.i=@netcraft.com header.b=oE0GmKZE header.a=rsa-sha256
header.s=default202405-yu9bqteb95aqcfpg x-bits=2048;
dmarc=pass policy.published-domain-policy=reject
policy.applied-disposition=none policy.evaluated-disposition=none
policy.policy-from=p header.from=netcraft.com;
spf=pass smtp.mailfrom=takedown-response+62456393@netcraft.com
smtp.helo=mail-1c.netcraft.com
Received-SPF: pass
(netcraft.com: 52.31.138.216 is authorized to use 'takedown-response+62456393@netcraft.com' in 'mfrom' identity (mechanism 'ip4:52.31.138.216' matched))
receiver=spamtitan-filter03.hostserv.co.za;
identity=mailfrom;
envelope-from="takedown-response+62456393@netcraft.com";
helo=mail-1c.netcraft.com;
client-ip=52.31.138.216
Received: from mail-1c.netcraft.com (mail-1c.netcraft.com [52.31.138.216])
(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)
key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256)
(No client certificate requested)
by spamtitan-filter03.hostserv.co.za (Postfix) with ESMTPS id 1FC10266C169
for <info@innovagency.co.za>; Wed, 16 Oct 2024 04:11:11 +0200 (SAST)
Received: from walleye.netcraft.com (unknown [10.9.0.81])
(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)
key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256)
(No client certificate requested)
by mail-1c.netcraft.com (Postfix) with ESMTPS id 6FB964F71
for <info@innovagency.co.za>; Wed, 16 Oct 2024 02:11:09 +0000 (UTC)
DKIM-Filter: OpenDKIM Filter v2.11.0 mail-1c.netcraft.com 6FB964F71
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=netcraft.com;
s=default202405-yu9bqteb95aqcfpg; t=1729044669;
bh=Wf7NjBiEBIGdNSzt9fwwKv9IiluzelKdIYYiGNRFXd8=;
h=Date:From:Subject:To:From;
b=oE0GmKZE1LPW6qsFIMGML4+tHnfSmjHey2TTX/3I2+6B8PvA/sd3WZAD0l1pwLihe
x4HnpP07Pu/TESHwmJc2yVhNwg/1JiWsuPWhHkkEv8UgO4DB3Y4pQsNXHDcr6o3fJ1
I043Wd1WHOveUwgX6FVOc0/aUcnTPoMqUr5laWnEWMdvQ09OkBIXg8rYd8I1I5A9lM
Q1YCnxJQeYoRPBSFXsgmDrmZJOA9XpYBdq9t2dypf/wPg/QfQYL/aBULrgX5hEd4zk
yXiZn/yHidst+unHkl8NE0dBDmMFKaQ+v4KVAXVSifH+VkuQTOjA5Q9BWrnV3m6DVi
zs6drG/kBMdsw==
Received: by walleye.netcraft.com (Postfix, from userid 507)
id 30AB214B9; Wed, 16 Oct 2024 02:11:09 +0000 (UTC)
Content-Transfer-Encoding: 8bit
Content-Type: multipart/report; boundary="_----------=_17290446692573915804"; report-type="feedback-report"
MIME-Version: 1.0
Date: Wed, 16 Oct 2024 02:11:09 +0000
From: Netcraft Takedown Service <takedown-response+62456393@netcraft.com>
Subject: Issue 62456393: Phishing attack at hxxps://isonxp.innovagency.co[.]za/wp-admin/x1/apib1.anz.com.apinetbank.htm
To: info@innovagency.co.za
Message-Id: <75ed92c3131d06507d6ad05c7604e7e1@takedown.netcraft.com>
X-Mailer: MIME::Lite 3.030 (F2.85; T2.17; A2.20; B3.15; Q3.13)
This is a multi-part message in MIME format.
--_----------=_17290446692573915804
Content-Disposition: inline
Content-Transfer-Encoding: 8bit
Content-Type: text/plain; charset="UTF-8"
Hello,
We have discovered a phishing attack on your network.
hxxps://isonxp.innovagency.co[.]za/wp-admin/x1/apib1.anz.com.apinetbank.htm [41.185.64.77]
hxxps://isonxp.innovagency.co[.]za/wp-admin/x1/loginInetANZ.php [41.185.64.77]
hxxps://www[.]isonxp.innovagency.co[.]za/wp-admin/x1/questions.html [41.185.64.77]
It is possible that this attack is being restricted so it is only visible from certain countries. Before deciding that the attack has been resolved please confirm it cannot be viewed from the following countries:
Australia
New Zealand
You may not have been aware of this attack, however, you are still responsible for removing it.
This attack targets our customer, ANZ Fiji, website URL http://www.anz.com/fiji/en/personal/.
Please remove this fraudulent content, and any other associated fraudulent content, as soon as possible.
Additionally, please keep the fraudulent content safe so that our customer and law enforcement agencies can investigate this incident further once the site is offline.
More information about the detected issue is provided at https://incident.netcraft.com/995c9c437ff1/
Kind regards,
Netcraft
Phone: +44(0)1225 447500
Fax: +44(0)1225 448600
Netcraft Issue Number: 62456393
To contact us about updates regarding this attack, please respond to this email. Please note: replies to this address will be logged, but aren't always read. If you believe you have received this email in error, or you require further support, please contact: takedown@netcraft.com.
This mail can be parsed with x-arf tools. Visit http://www.xarf.org/ for more information about x-arf.
--_----------=_17290446692573915804
Content-Disposition: inline
Content-Transfer-Encoding: 7bit
Content-Type: message/feedback-report
MIME-Version: 1.0
X-Mailer: MIME::Lite 3.030 (F2.85; T2.17; A2.20; B3.15; Q3.13)
Date: Wed, 16 Oct 2024 02:11:09 +0000
Feedback-Type: xarf
User-Agent: Netcraft
Version: 1
--_----------=_17290446692573915804
Content-Disposition: attachment; filename="xarf.json"
Content-Transfer-Encoding: base64
Content-Type: application/json; charset=utf-8; name="xarf.json"
MIME-Version: 1.0
X-Mailer: MIME::Lite 3.030 (F2.85; T2.17; A2.20; B3.15; Q3.13)
Date: Wed, 16 Oct 2024 02:11:09 +0000
eyJSZXBvcnRlckluZm8iOnsiUmVwb3J0ZXJPcmdEb21haW4iOiJuZXRjcmFmdC5jb20iLCJSZXBv
cnRlck9yZ0VtYWlsIjoidGFrZWRvd24tcmVzcG9uc2UrNjI0NTYzOTNAbmV0Y3JhZnQuY29tIiwi
UmVwb3J0ZXJPcmciOiJOZXRjcmFmdCJ9LCJPbkJlaGFsZk9mIjp7IkNvbXBsYWluYW50T3JnRW1h
aWwiOiJ0YWtlZG93bi1yZXNwb25zZSs2MjQ1NjM5M0BuZXRjcmFmdC5jb20iLCJDb21wbGFpbmFu
dE9yZyI6IkFOWiBGaWppIiwiQ29tcGxhaW5hbnRPcmdEb21haW4iOiJ3d3cuYW56LmNvbSJ9LCJS
ZXBvcnQiOnsiRGF0ZSI6IjIwMjQtMTAtMTZUMDE6NTM6MDNaIiwiU291cmNlSXAiOiI0MS4xODUu
NjQuNzciLCJSZXBvcnRlck5vdGVzIjoiU2VlIGh0dHBzOi8vaW5jaWRlbnQubmV0Y3JhZnQuY29t
Lzk5NWM5YzQzN2ZmMS8gZm9yIG1vcmUgaW5mb3JtYXRpb24iLCJSZXBvcnRDbGFzcyI6IkNvbnRl
bnQiLCJSZXBvcnRlckNhc2VJRCI6IjYyNDU2MzkzIiwiU291cmNlVXJsIjoiaHR0cHM6Ly9pc29u
eHAuaW5ub3ZhZ2VuY3kuY28uemEvd3AtYWRtaW4veDEvYXBpYjEuYW56LmNvbS5hcGluZXRiYW5r
Lmh0bSIsIlJlcG9ydFR5cGUiOiJQaGlzaGluZyJ9LCJEaXNjbG9zdXJlIjp0cnVlLCJWZXJzaW9u
IjoiMSJ9
--_----------=_17290446692573915804--