1#@!#!123s

https 1#@!#!123s
: / home2 / hershinecreation / mail / new /
Filename : 1739849016.M406353P15026.server55.dnsserverboot.com,S=5521,W=5632
back
Envelope-to: support@hershinecreations.com
Delivery-date: Tue, 18 Feb 2025 08:53:36 +0530
Content-Transfer-Encoding: 8bit
Content-Type: multipart/report; boundary="_----------=_17398489752683862559"; report-type="feedback-report"
MIME-Version: 1.0
Date: Tue, 18 Feb 2025 03:22:55 +0000
From: Netcraft Takedown Service <takedown-response+67124077@netcraft.com>
Subject: Issue 67124077: Phishing attack at hxxps://hershinecreations[.]com/Contract_Agreement_2025_Revised/DocuSignloadingpleaseverify29984598ut8h8u85
To: support@hershinecreations.com
Message-Id: <a6515dbda90fef9049e53f1fac78e4b9@takedown.netcraft.com>

This is a multi-part message in MIME format.

--_----------=_17398489752683862559
Content-Disposition: inline
Content-Transfer-Encoding: 8bit
Content-Type: text/plain; charset="UTF-8"

Hello,

We have discovered a phishing attack on your network.

hxxps://hershinecreations[.]com/Contract_Agreement_2025_Revised/DocuSignloadingpleaseverify29984598ut8h8u85

You may not have been aware of this attack, however, you are still responsible for removing it.

This attack targets our customer, Microsoft, website URL https://www.microsoft.com/.

Please remove this fraudulent content, and any other associated fraudulent content, as soon as possible.

Additionally, please keep the fraudulent content safe so that our customer and law enforcement agencies can investigate this incident further once the site is offline.

More information about the detected issue is provided at https://incident.netcraft.com/4c3eadbe9f5d/

Kind regards,

Netcraft

Phone: +44(0)1225 447500
Fax: +44(0)1225 448600
Netcraft Issue Number: 67124077

To contact us about updates regarding this attack, please respond to this email. Please note: replies to this address will be logged, but aren't always read. If you believe you have received this email in error, or you require further support, please contact: support@netcraft.com.

This mail can be parsed with x-arf tools. Visit http://www.xarf.org/ for more information about x-arf.
--_----------=_17398489752683862559
Content-Disposition: inline
Content-Transfer-Encoding: 7bit
Content-Type: message/feedback-report
MIME-Version: 1.0
X-Mailer: MIME::Lite 3.030 (F2.85; T2.17; A2.20; B3.15; Q3.13)
Date: Tue, 18 Feb 2025 03:22:55 +0000

Feedback-Type: xarf
User-Agent: Netcraft
Version: 1
--_----------=_17398489752683862559
Content-Disposition: attachment; filename="xarf.json"
Content-Transfer-Encoding: base64
Content-Type: application/json; charset=utf-8; name="xarf.json"
MIME-Version: 1.0
X-Mailer: MIME::Lite 3.030 (F2.85; T2.17; A2.20; B3.15; Q3.13)
Date: Tue, 18 Feb 2025 03:22:55 +0000

eyJPbkJlaGFsZk9mIjp7IkNvbXBsYWluYW50T3JnRW1haWwiOiJ0YWtlZG93bi1yZXNwb25zZSs2
NzEyNDA3N0BuZXRjcmFmdC5jb20iLCJDb21wbGFpbmFudE9yZ0RvbWFpbiI6Ind3dy5taWNyb3Nv
ZnQuY29tIiwiQ29tcGxhaW5hbnRPcmciOiJNaWNyb3NvZnQifSwiUmVwb3J0Ijp7IlJlcG9ydGVy
Q2FzZUlEIjoiNjcxMjQwNzciLCJTb3VyY2VVcmwiOiJodHRwczovL2hlcnNoaW5lY3JlYXRpb25z
LmNvbS9Db250cmFjdF9BZ3JlZW1lbnRfMjAyNV9SZXZpc2VkL0RvY3VTaWdubG9hZGluZ3BsZWFz
ZXZlcmlmeTI5OTg0NTk4dXQ4aDh1ODUiLCJSZXBvcnRlck5vdGVzIjoiU2VlIGh0dHBzOi8vaW5j
aWRlbnQubmV0Y3JhZnQuY29tLzRjM2VhZGJlOWY1ZC8gZm9yIG1vcmUgaW5mb3JtYXRpb24iLCJT
b3VyY2VJcCI6IjE3Mi42Ny4xNzguMTM2IiwiUmVwb3J0Q2xhc3MiOiJDb250ZW50IiwiRGF0ZSI6
IjIwMjUtMDItMThUMDM6MjA6MzNaIiwiUmVwb3J0VHlwZSI6IlBoaXNoaW5nIn0sIlZlcnNpb24i
OiIxIiwiUmVwb3J0ZXJJbmZvIjp7IlJlcG9ydGVyT3JnRW1haWwiOiJ0YWtlZG93bi1yZXNwb25z
ZSs2NzEyNDA3N0BuZXRjcmFmdC5jb20iLCJSZXBvcnRlck9yZ0RvbWFpbiI6Im5ldGNyYWZ0LmNv
bSIsIlJlcG9ydGVyT3JnIjoiTmV0Y3JhZnQifSwiRGlzY2xvc3VyZSI6dHJ1ZX0=

--_----------=_17398489752683862559--