name : 1729044679.M523860P1577568.imr70-cvps01.hostserv.co.za,S=8190,W=8351 Return-Path: <takedown-response+62456393@netcraft.com> Delivered-To: innovagencyco@imr70-cvps01.hostserv.co.za Received: from imr70-cvps01.hostserv.co.za by imr70-cvps01.hostserv.co.za with LMTP id cGrQHccgD2dgEhgA+LLMVA (envelope-from <takedown-response+62456393@netcraft.com>) for <innovagencyco@imr70-cvps01.hostserv.co.za>; Wed, 16 Oct 2024 04:11:19 +0200 Return-path: <takedown-response+62456393@netcraft.com> Envelope-to: info@innovagency.co.za Delivery-date: Wed, 16 Oct 2024 04:11:19 +0200 Received: from spamtitan-filter03.hostserv.co.za ([41.185.250.30]:28922) by imr70-cvps01.hostserv.co.za with esmtp (Exim 4.97.1) (envelope-from <takedown-response+62456393@netcraft.com>) id 1t0tVP-00000006fS2-2KdF for info@innovagency.co.za; Wed, 16 Oct 2024 04:11:19 +0200 Received: from localhost (localhost [127.0.0.1]) by spamtitan-filter03.hostserv.co.za (Postfix) with ESMTP id CECD9266C2B1 for <info@innovagency.co.za>; Wed, 16 Oct 2024 04:11:18 +0200 (SAST) X-Quarantine-ID: <Is8U1oa1zAIs> X-Virus-Scanned: by SpamTitan at hostserv.co.za X-Spam-Flag: NO X-Spam-Score: 1.71 X-Spam-Level: * X-Spam-Status: No, score=1.71 tagged_above=-999 required=5 tests=[ANY_BOUNCE_MESSAGE=0.1, BOUNCE_MESSAGE=0.1, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, DNSWL_DWL_MED=-0.2, KAM_SHORT=0.001, RCVD_IN_DNSWL_BLOCKED=0.001, RCVD_IN_MSPIKE_H2=-0.001, RCVD_IN_SPFWL=-0.2, RCVD_IN_VALIDITY_CERTIFIED_BLOCKED=0.001, RCVD_IN_VALIDITY_RPBL_BLOCKED=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, ST_KGM_OBFUSCATE_1=0.4, ST_KGM_OBFUSCATE_2=0.8, ST_LONG_ENVELOPE_FROM=0.906, URIBL_BLOCKED=0.001] autolearn=disabled Received: from spamtitan-filter03.hostserv.co.za (localhost [127.0.0.1]) by spamtitan-filter03.hostserv.co.za (Postfix) with ESMTP id 7DFAE266C11A for <info@innovagency.co.za>; Wed, 16 Oct 2024 04:11:14 +0200 (SAST) Authentication-Results: spamtitan-filter03.hostserv.co.za; dkim=pass (2048-bit rsa key sha256) header.d=netcraft.com header.i=@netcraft.com header.b=oE0GmKZE header.a=rsa-sha256 header.s=default202405-yu9bqteb95aqcfpg x-bits=2048; dmarc=pass policy.published-domain-policy=reject policy.applied-disposition=none policy.evaluated-disposition=none policy.policy-from=p header.from=netcraft.com; spf=pass smtp.mailfrom=takedown-response+62456393@netcraft.com smtp.helo=mail-1c.netcraft.com Received-SPF: pass (netcraft.com: 52.31.138.216 is authorized to use 'takedown-response+62456393@netcraft.com' in 'mfrom' identity (mechanism 'ip4:52.31.138.216' matched)) receiver=spamtitan-filter03.hostserv.co.za; identity=mailfrom; envelope-from="takedown-response+62456393@netcraft.com"; helo=mail-1c.netcraft.com; client-ip=52.31.138.216 Received: from mail-1c.netcraft.com (mail-1c.netcraft.com [52.31.138.216]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by spamtitan-filter03.hostserv.co.za (Postfix) with ESMTPS id 1FC10266C169 for <info@innovagency.co.za>; Wed, 16 Oct 2024 04:11:11 +0200 (SAST) Received: from walleye.netcraft.com (unknown [10.9.0.81]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mail-1c.netcraft.com (Postfix) with ESMTPS id 6FB964F71 for <info@innovagency.co.za>; Wed, 16 Oct 2024 02:11:09 +0000 (UTC) DKIM-Filter: OpenDKIM Filter v2.11.0 mail-1c.netcraft.com 6FB964F71 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=netcraft.com; s=default202405-yu9bqteb95aqcfpg; t=1729044669; bh=Wf7NjBiEBIGdNSzt9fwwKv9IiluzelKdIYYiGNRFXd8=; h=Date:From:Subject:To:From; b=oE0GmKZE1LPW6qsFIMGML4+tHnfSmjHey2TTX/3I2+6B8PvA/sd3WZAD0l1pwLihe x4HnpP07Pu/TESHwmJc2yVhNwg/1JiWsuPWhHkkEv8UgO4DB3Y4pQsNXHDcr6o3fJ1 I043Wd1WHOveUwgX6FVOc0/aUcnTPoMqUr5laWnEWMdvQ09OkBIXg8rYd8I1I5A9lM Q1YCnxJQeYoRPBSFXsgmDrmZJOA9XpYBdq9t2dypf/wPg/QfQYL/aBULrgX5hEd4zk yXiZn/yHidst+unHkl8NE0dBDmMFKaQ+v4KVAXVSifH+VkuQTOjA5Q9BWrnV3m6DVi zs6drG/kBMdsw== Received: by walleye.netcraft.com (Postfix, from userid 507) id 30AB214B9; Wed, 16 Oct 2024 02:11:09 +0000 (UTC) Content-Transfer-Encoding: 8bit Content-Type: multipart/report; boundary="_----------=_17290446692573915804"; report-type="feedback-report" MIME-Version: 1.0 Date: Wed, 16 Oct 2024 02:11:09 +0000 From: Netcraft Takedown Service <takedown-response+62456393@netcraft.com> Subject: Issue 62456393: Phishing attack at hxxps://isonxp.innovagency.co[.]za/wp-admin/x1/apib1.anz.com.apinetbank.htm To: info@innovagency.co.za Message-Id: <75ed92c3131d06507d6ad05c7604e7e1@takedown.netcraft.com> X-Mailer: MIME::Lite 3.030 (F2.85; T2.17; A2.20; B3.15; Q3.13) This is a multi-part message in MIME format. --_----------=_17290446692573915804 Content-Disposition: inline Content-Transfer-Encoding: 8bit Content-Type: text/plain; charset="UTF-8" Hello, We have discovered a phishing attack on your network. hxxps://isonxp.innovagency.co[.]za/wp-admin/x1/apib1.anz.com.apinetbank.htm [41.185.64.77] hxxps://isonxp.innovagency.co[.]za/wp-admin/x1/loginInetANZ.php [41.185.64.77] hxxps://www[.]isonxp.innovagency.co[.]za/wp-admin/x1/questions.html [41.185.64.77] It is possible that this attack is being restricted so it is only visible from certain countries. Before deciding that the attack has been resolved please confirm it cannot be viewed from the following countries: Australia New Zealand You may not have been aware of this attack, however, you are still responsible for removing it. This attack targets our customer, ANZ Fiji, website URL http://www.anz.com/fiji/en/personal/. Please remove this fraudulent content, and any other associated fraudulent content, as soon as possible. Additionally, please keep the fraudulent content safe so that our customer and law enforcement agencies can investigate this incident further once the site is offline. More information about the detected issue is provided at https://incident.netcraft.com/995c9c437ff1/ Kind regards, Netcraft Phone: +44(0)1225 447500 Fax: +44(0)1225 448600 Netcraft Issue Number: 62456393 To contact us about updates regarding this attack, please respond to this email. Please note: replies to this address will be logged, but aren't always read. If you believe you have received this email in error, or you require further support, please contact: takedown@netcraft.com. This mail can be parsed with x-arf tools. Visit http://www.xarf.org/ for more information about x-arf. --_----------=_17290446692573915804 Content-Disposition: inline Content-Transfer-Encoding: 7bit Content-Type: message/feedback-report MIME-Version: 1.0 X-Mailer: MIME::Lite 3.030 (F2.85; T2.17; A2.20; B3.15; Q3.13) Date: Wed, 16 Oct 2024 02:11:09 +0000 Feedback-Type: xarf User-Agent: Netcraft Version: 1 --_----------=_17290446692573915804 Content-Disposition: attachment; filename="xarf.json" Content-Transfer-Encoding: base64 Content-Type: application/json; charset=utf-8; name="xarf.json" MIME-Version: 1.0 X-Mailer: MIME::Lite 3.030 (F2.85; T2.17; A2.20; B3.15; Q3.13) Date: Wed, 16 Oct 2024 02:11:09 +0000 eyJSZXBvcnRlckluZm8iOnsiUmVwb3J0ZXJPcmdEb21haW4iOiJuZXRjcmFmdC5jb20iLCJSZXBv cnRlck9yZ0VtYWlsIjoidGFrZWRvd24tcmVzcG9uc2UrNjI0NTYzOTNAbmV0Y3JhZnQuY29tIiwi UmVwb3J0ZXJPcmciOiJOZXRjcmFmdCJ9LCJPbkJlaGFsZk9mIjp7IkNvbXBsYWluYW50T3JnRW1h aWwiOiJ0YWtlZG93bi1yZXNwb25zZSs2MjQ1NjM5M0BuZXRjcmFmdC5jb20iLCJDb21wbGFpbmFu dE9yZyI6IkFOWiBGaWppIiwiQ29tcGxhaW5hbnRPcmdEb21haW4iOiJ3d3cuYW56LmNvbSJ9LCJS ZXBvcnQiOnsiRGF0ZSI6IjIwMjQtMTAtMTZUMDE6NTM6MDNaIiwiU291cmNlSXAiOiI0MS4xODUu NjQuNzciLCJSZXBvcnRlck5vdGVzIjoiU2VlIGh0dHBzOi8vaW5jaWRlbnQubmV0Y3JhZnQuY29t Lzk5NWM5YzQzN2ZmMS8gZm9yIG1vcmUgaW5mb3JtYXRpb24iLCJSZXBvcnRDbGFzcyI6IkNvbnRl bnQiLCJSZXBvcnRlckNhc2VJRCI6IjYyNDU2MzkzIiwiU291cmNlVXJsIjoiaHR0cHM6Ly9pc29u eHAuaW5ub3ZhZ2VuY3kuY28uemEvd3AtYWRtaW4veDEvYXBpYjEuYW56LmNvbS5hcGluZXRiYW5r Lmh0bSIsIlJlcG9ydFR5cGUiOiJQaGlzaGluZyJ9LCJEaXNjbG9zdXJlIjp0cnVlLCJWZXJzaW9u IjoiMSJ9 --_----------=_17290446692573915804--