1#@!#!123s

32759 1#@!#!123s
: / home / alliance / mail / cur /
Filename : 1675397731.M725157P10364.server1.kavintechsolutions.tld,S=12467,W=12669:2,S
back
Envelope-to: alliance@server1.kavintechsolutions.tld
Delivery-date: Fri, 03 Feb 2023 04:15:31 +0000
Auto-Submitted: auto-replied
From: Mail Delivery System <Mailer-Daemon@server1.kavintechsolutions.tld>
To: alliance@server1.kavintechsolutions.tld
References: <E1pNnTz-0002uE-ML@server1.kavintechsolutions.tld>
Content-Type: multipart/report; report-type=delivery-status; boundary=1675397731-eximdsn-1080779621
MIME-Version: 1.0
Subject: Mail delivery failed: returning message to sender
Message-Id: <E1pNnU3-0002v6-Ks@server1.kavintechsolutions.tld>
Date: Fri, 03 Feb 2023 04:15:31 +0000

--1675397731-eximdsn-1080779621
Content-type: text/plain; charset=us-ascii

This message was created automatically by mail delivery software.

A message that you sent could not be delivered to one or more of its
recipients. This is a permanent error. The following address(es) failed:

  alliance@singnet.com.sg
    host mx-10.orchid.atmailcloud.com [52.220.151.121]
    SMTP error from remote mail server after pipelined MAIL FROM:<alliance@server1.kavintechsolutions.tld> SIZE=11537:
    550 mf-202: Invalid sender address

--1675397731-eximdsn-1080779621
Content-type: message/delivery-status

Reporting-MTA: dns; server1.kavintechsolutions.tld

Action: failed
Final-Recipient: rfc822;alliance@singnet.com.sg
Status: 5.0.0
Remote-MTA: dns; mx-10.orchid.atmailcloud.com
Diagnostic-Code: smtp; 550 mf-202: Invalid sender address

--1675397731-eximdsn-1080779621
Content-type: message/rfc822

Return-path: <alliance@server1.kavintechsolutions.tld>
Received: from alliance by server1.kavintechsolutions.tld with local (Exim 4.93)
	(envelope-from <alliance@server1.kavintechsolutions.tld>)
	id 1pNnTz-0002uE-ML; Fri, 03 Feb 2023 04:15:29 +0000
To: alliance@singnet.com.sg
Subject: [PL-3442575] Phishing attack(s) hosted on: allianceinstrumentation.com.sg
X-PHP-Script: allianceinstrumentation.com.sg/mail.php for 71.79.108.80
X-PHP-Originating-Script: 660:mail.php
MIME-Version: 1.0
Content-type:text/html;charset=UTF-8
From: soc@phishlabs.com
Cc: periyasamyanbu@gmail.com
Message-Id: <E1pNnTz-0002uE-ML@server1.kavintechsolutions.tld>
Date: Fri, 03 Feb 2023 04:15:27 +0000
X-OutGoing-Spam-Status: No, score=1.2

<html>
    
        <style>

tr:nth-child(even) {
    background-color: #dddddd;
}
</style>
    
<body>
<div>
<div style="background-color:#eee;margin:0;padding:0;font-family:Roboto,Arial,sans-serif;font-weight:500;color:#f0f0f0;font-size:16px">
  <p>&nbsp;</p>
  <table style="width:100%;border-collapse:collapse;" cellspacing="0" cellpadding="0" border="0">
      <tbody>
      <tr style="font-size:14px;color:#545f75">
          <td>&nbsp;</td>
          <td style="width:600px">
              <table style="width:120%;border-collapse:collapse;background-color:#fff; border: 5px solid #304296;" cellspacing="0" cellpadding="0" border="0">
                  <tbody>
                  <tr>
                      <td>
                          <div style="padding:0px 0;text-align:center;background-color:#304296;"><img src="http://allianceinstrumentation.com.sg/img/alliance/AllianceLogoheader.png" width="40%" height="35%" style="margin-top: 25px;" >
                              
                              
                              
                          </div>
                          <div style="line-height:1px">
                              <div style="padding:20px 0px; background: #304296;">
                                  <center><h3 style="color: #fff;font-weight: bold;">Contact Us</h3></center>
                                  <table width="600" align="center"  class="m_3287099250725901192m_3113577391825144384tt"> 
                                    <tbody>              
                                        <tr style="text-align:left;vertical-align:top;background:#fff">
                                        <td style="text-align: center;background:#e4121b;"><img src="http://allianceinstrumentation.com.sg/img/alliance/1.jpg" width="50" height="50"> </td>
                                        <td style="padding: 10px;"><p>Ryan Neil Bacalso</p></td>
                                        </tr>
                                        <tr></tr><tr></tr><tr></tr><tr></tr>
                                        <tr style="text-align:left;vertical-align:top;background:#fff">
                                        <td style="text-align: center;background:#e4121b;"><img src="http://allianceinstrumentation.com.sg/img/alliance/2.jpg" width="50" height="50"></td>
                                        <td style="padding: 10px;"><a href="mailto:soc@phishlabs.com" target="_blank"><p>soc@phishlabs.com</p></a></td>
                                        </tr>
                                        <tr></tr><tr></tr><tr></tr><tr></tr>
                                        <tr style="text-align:left;vertical-align:top;background:#fff">
                                        <td style="text-align: center;background:#e4121b;"><img src="http://allianceinstrumentation.com.sg/img/alliance/3.jpg" width="50" height="50"> </td>
                                        <td style="padding: 10px;">12023866001</p></td>
                                        </tr>
                                        <tr></tr><tr></tr><tr></tr><tr></tr>
                                        <tr style="text-align:left;vertical-align:top;background:#fff">
                                        <td style="text-align: center;background:#e4121b;"><img src="http://allianceinstrumentation.com.sg/img/alliance/4.jpg" width="50" height="50"> </td>
                                        <td style="padding: 10px;">[PL-3442575] Phishing attack(s) hosted on: allianceinstrumentation.com.sg</p></td>
                                        </tr>
                                        <tr></tr><tr></tr><tr></tr><tr></tr>
                                        <tr style="text-align:left;vertical-align:top;background:#fff">
                                        <td style="text-align: center;background:#e4121b;"><img src="http://allianceinstrumentation.com.sg/img/alliance/5.jpg" width="50" height="50"></td>
                                        <td style="padding: 10px;"><textarea rows="4" cols="70" style="border:none" readonly>

During an investigation of fraud, we discovered a compromised website (allianceinstrumentation.com.sg) that is being used to attack our client and their customers.

In addition to the website owner, we have addressed this report to the responsible authoritative providers who have the ability to disable the malicious content in question. Based on your relationship to the content in question, please see our specific request below.

This threat has been active for at least 34.2 hours.

https://allianceinstrumentation.com.sg/spp/knhxh8drfj17c1ll56a3szw0.php?A3A6L71675368022b2fc4c26bda59c7ccce2bdbb28f769a5b2fc4c26bda59c7ccce2bdbb28f769a5b2fc4c26bda59c7ccce2bdbb28f769a5b2fc4c26bda59c7ccce2bdbb28f769a5b2fc4c26bda59c7ccce2bdbb28f769a5=&email=
https://allianceinstrumentation.com.sg/spp/
https://allianceinstrumentation.com.sg/spp/e296a1749k9zwcp3b38grz3n.php?8b3K631675278912f34ce4db2adc2852844f33be45b18778f34ce4db2adc2852844f33be45b18778f34ce4db2adc2852844f33be45b18778f34ce4db2adc2852844f33be45b18778f34ce4db2adc2852844f33be45b18778=&email=
https://allianceinstrumentation.com.sg/spp/fidpd82z55h4rdnmomj1p8cg.php?5G0F6K1675343710bd2a390b41eb545c983115082d3472e7bd2a390b41eb545c983115082d3472e7bd2a390b41eb545c983115082d3472e7bd2a390b41eb545c983115082d3472e7bd2a390b41eb545c983115082d3472e7=&email=
https://allianceinstrumentation.com.sg/spp/04xzyddbukmszeh9vpdyvpz0.php?L3520G1675343716307cb1cfee758312340a279599e059e2307cb1cfee758312340a279599e059e2307cb1cfee758312340a279599e059e2307cb1cfee758312340a279599e059e2307cb1cfee758312340a279599e059e2=&email=
https://allianceinstrumentation.com.sg/spp/59ituqti15imo3oy2c47n4tw.php?AD22HA1675349110800db670959dcc1037cc0d44c2f1bec0800db670959dcc1037cc0d44c2f1bec0800db670959dcc1037cc0d44c2f1bec0800db670959dcc1037cc0d44c2f1bec0800db670959dcc1037cc0d44c2f1bec0=&email=
https://allianceinstrumentation.com.sg/spp/lvqowiwog9x566xkeblr67r3.php?LHK5C916753680250b9bd40ac22f99dc2733c009f87438d90b9bd40ac22f99dc2733c009f87438d90b9bd40ac22f99dc2733c009f87438d90b9bd40ac22f99dc2733c009f87438d90b9bd40ac22f99dc2733c009f87438d9=&email=
https://allianceinstrumentation.com.sg/spp/uhltwd56nn9g6e39c2s1v13l.php?9C016J1675274449745b1a39cdaea46557e4891da734ae5c745b1a39cdaea46557e4891da734ae5c745b1a39cdaea46557e4891da734ae5c745b1a39cdaea46557e4891da734ae5c745b1a39cdaea46557e4891da734ae5c=&email=
https://allianceinstrumentation.com.sg/spp
https://allianceinstrumentation.com.sg/spp/3tkztuuo1oelpqkz5u5f0cd0.php?A8C1bJ16752782040a1e889d0693c82cc0f2ddbba954f6c30a1e889d0693c82cc0f2ddbba954f6c30a1e889d0693c82cc0f2ddbba954f6c30a1e889d0693c82cc0f2ddbba954f6c30a1e889d0693c82cc0f2ddbba954f6c3=&email=
https://allianceinstrumentation.com.sg/spp/lzb0qvfn0yfjwlikuz9dpssn.php?F13HA2167529692349cd8c043de313a8570a3980939671ec49cd8c043de313a8570a3980939671ec49cd8c043de313a8570a3980939671ec49cd8c043de313a8570a3980939671ec49cd8c043de313a8570a3980939671ec=&email=
https://allianceinstrumentation.com.sg/spp/n4gfth9tsmr4s13q152nip16.php?0JLib4167529692685be3bfc1359698ba6a84cd76c07f21b85be3bfc1359698ba6a84cd76c07f21b85be3bfc1359698ba6a84cd76c07f21b85be3bfc1359698ba6a84cd76c07f21b85be3bfc1359698ba6a84cd76c07f21b=&email=

First detection of malicious activity: 02-01-2023 18:00:58 UTC
Most recent observation of malicious activity: 02-03-2023 04:10:36 UTC
Associated IP Addresses:
103.15.234.11

===   HOSTING  PROVIDER   ===
If you agree that this is malicious, we kindly request that you take steps to have the content removed as soon as possible.  It is highly likely that the intruder who set up this phishing content has also left additional fraudulent material on this server such as illegitimate access points.

===     WEBSITE OWNER     ===
We recommend taking the following actions to secure the web site and prevent the attackers from returning:
    - Update your web applications including CMS, blog, ecommerce, and other applications (and all add-on modules/components/plugins).
    - Search all of your web directories for suspicious files as attackers commonly leave backdoors.
    - Scan the computer from which you login to your web hosting control panel or ftp server with anti-virus software. 
    - Change your web hosting provider if this is an ongoing issue.

If your provider has disabled your account because of this incident, you must coordinate a resolution with them directly as PhishLabs has no control over this aspect.

If we have contacted you in error, or if there is a better way for us to report this incident, please let us know so that we may continue our investigation.

We are grateful for your assistance.  


Kind regards,  
SOC Team
PhishLabs Security Operations
12023866001
Available 24/7


[PL-3442575] 
</textarea></td>
                                        </tr>                                                         
                                    </tbody>
                                   </table>
                                  
                              </div>
                          </div>
                      </td>
                  </tr>
                  </tbody>
              </table>
          </td>
          <td>&nbsp;</td>
      </tr>
      <tr style="color:white;text-align:center">
          <td>&nbsp;</td>
          <td>
              <div style="color:#172032;line-height:1.5;margin:25px 0;font-size:14px"><a style="text-decoration: none;margin-left: 130px;">© ALLIANCE INSTRUMENTATION PTE LTD.All rights reserved.</a></div>
          </td>
          <td>&nbsp;</td>
      </tr>

      </tbody>
  </table><div class="yj6qo"></div><div class="adL">
</div></div><div class="adL">
</div></div>
</body>
</html></div>

--1675397731-eximdsn-1080779621--