CLEAN MX realtime database
safe Phish viewer

hex view of evidence ...
0: 3C21444F43545950452048544D4C3E0A0A3C212D2D5B6966206C742049452037          <!DOCTYPE HTML> <!--[if lt IE 7
32: 5D3E203C68746D6C206C616E673D22656E2D75732220636C6173733D226C742D          ]> <html lang="en-us" class="lt-
64: 696539206C742D696538206C742D696537223E203C215B656E6469665D2D2D3E          ie9 lt-ie8 lt-ie7"> <![endif]-->
96: 0A3C212D2D5B696620494520375D3E202020203C68746D6C206C616E673D2265          <!--[if IE 7]> <html lang="e
128: 6E2D75732220636C6173733D226C742D696539206C742D696538223E203C215B          n-us" class="lt-ie9 lt-ie8"> <![
160: 656E6469665D2D2D3E0A3C212D2D5B696620494520385D3E202020203C68746D          endif]--> <!--[if IE 8]> <htm
192: 6C206C616E673D22656E2D75732220636C6173733D226C742D696539223E203C          l lang="en-us" class="lt-ie9"> <
224: 215B656E6469665D2D2D3E0A3C212D2D5B696620677420494520385D3E3C212D          ![endif]--> <!--[if gt IE 8]><!-
256: 2D3E203C68746D6C206C616E673D22656E2D7573223E203C212D2D3C215B656E          -> <html lang="en-us"> <!--<![en
288: 6469665D2D2D3E0A202020203C686561643E0A20202020202020203C6D657461          dif]--> <head> <meta
320: 20687474702D65717569763D22636F6E74656E742D747970652220636F6E7465          http-equiv="content-type" conte
352: 6E743D22746578742F68746D6C3B20636861727365743D5554462D38223E0A20          nt="text/html; charset=UTF-8">
384: 202020202020203C6D65746120636861727365743D225554462D38223E0A2020          <meta charset="UTF-8">
416: 2020202020203C7469746C653E537573706563746564207068697368696E6720          <title>Suspected phishing
448: 736974653C2F7469746C653E0A20202020202020203C6C696E6B2072656C3D22          site</title> <link rel="
480: 7374796C65736865657422206D656469613D2273637265656E2220687265663D          stylesheet" media="screen" href=
512: 222F63646E2D6367692F7374796C65732F70686973682F616E74692D70686973          "/cdn-cgi/styles/phish/anti-phis
544: 68696E672E63737322202F3E0A202020203C2F686561643E0A202020203C626F          hing.css" /> </head> <bo
576: 64793E0A20202020202020203C7461626C652077696474683D22313030252220          dy> <table width="1  %"
608: 6865696768743D2231303025222063656C6C70616464696E673D223330223E0A          height="1  %" cellpadding="3 ">
640: 2020202020202020202020203C74723E0A202020202020202020202020202020          <tr>
672: 203C74643E0A20202020202020202020202020202020202020203C6469762063          <td> <div c
704: 6C6173733D2277726170706572223E0A20202020202020202020202020202020          lass="wrapper">
736: 20202020202020203C64697620636C6173733D22726F772063656E7465726564          <div class="row centered
768: 223E0A202020202020202020202020202020202020202020202020202020203C          "> <
800: 696D67207372633D222F63646E2D6367692F696D616765732F70686973682F72          img src="/cdn-cgi/images/phish/r
832: 65642D6578636C616D6174696F6E2E706E67223E0A2020202020202020202020          ed-exclamation.png">
864: 20202020202020202020202020202020203C68313E5761726E696E673A205375          <h1>Warning: Su
896: 73706563746564207068697368696E6720706167653C2F68313E0A2020202020          spected phishing page</h1>
928: 20202020202020202020202020202020202020202020203C703E54686520666F          <p>The fo
960: 6C6C6F77696E672077656273697465207061676520686173206265656E207265          llowing website page has been re
992: 706F727465642061732061207068697368696E6720706167653A3C2F62723E3C          ported as a phishing page:</br><
1024: 7374726F6E673E687474703A2F2F6C69746574622E636F6D2F75706C6F616473          strong>http://litetb.com/uploads
1056: 2F313930353438363334392E786435303173322E6578653C2F7374726F6E673E          /19 5486349.xd5 1s2.exe</strong>
1088: 3C2F703E0A2020202020202020202020202020202020202020202020203C2F64          </p> </d
1120: 69763E0A2020202020202020202020202020202020202020202020203C646976          iv> <div
1152: 20636C6173733D22726F77223E0A202020202020202020202020202020202020          class="row">
1184: 202020202020202020203C64697620636C6173733D22636F6C223E0A20202020          <div class="col">
1216: 202020202020202020202020202020202020202020202020202020203C68323E          <h2>
1248: 576861742068617070656E65643F3C2F68323E0A202020202020202020202020          What happened?</h2>
1280: 20202020202020202020202020202020202020203C703E546869732070616765          <p>This page
1312: 206861732061207068697368696E672076756C6E65726162696C6974792E2050          has a phishing vulnerability. P
1344: 68697368696E6720617474656D70747320746F20616371756972652070657273          hishing attempts to acquire pers
1376: 6F6E616C20696E666F726D6174696F6E20737563682061732070617373776F72          onal information such as passwor
1408: 647320616E642063726564697420636172642064657461696C73206279207072          ds and credit card details by pr
1440: 6574656E64696E6720746F2062652061207472757374776F7274687920736F75          etending to be a trustworthy sou
1472: 7263652E3C2F703E0A2020202020202020202020202020202020202020202020          rce.</p>
1504: 2020202020202020203C7020636C6173733D2265787472615F70617273706163          <p class="extra_parspac
1536: 65223E5468652077656273697465206F776E657220686173206265656E206E6F          e">The website owner has been no
1568: 74696669656420616E6420697320696E207468652070726F63657373206F6620          tified and is in the process of
1600: 7265736F6C76696E67207468652069737375652E20466F72206E6F772C206974          resolving the issue. For now, it
1632: 206973207265636F6D6D656E646564207468617420796F7520646F206E6F7420          is recommended that you do not
1664: 636F6E74696E756520746F2076696577207468652077656220706167652E3C2F          continue to view the web page.</
1696: 703E0A202020202020202020202020202020202020202020202020202020203C          p> <
1728: 2F6469763E0A2020202020202020202020202020202020202020202020202020          /div>
1760: 20203C64697620636C6173733D22636F6C206C617374223E0A20202020202020          <div class="col last">
1792: 202020202020202020202020202020202020202020202020203C666F726D2061          <form a
1824: 6374696F6E3D2263646E2D6367692F70686973682D62797061737322206D6574          ction="cdn-cgi/phish-bypass" met
1856: 686F643D27474554273E0A202020202020202020202020202020202020202020          hod='GET'>
1888: 2020202020202020202020202020203C696E70757420747970653D2768696464          <input type='hidd
1920: 656E27206E616D653D2775272076616C75653D222F75706C6F6164732F313930          en' name='u' value="/uploads/19 
1952: 353438363334392E786435303173322E657865223E0A20202020202020202020          5486349.xd5 1s2.exe">
1984: 20202020202020202020202020202020202020202020202020203C696E707574          <input
2016: 20747970653D2768696464656E27206E616D653D2761746F6B272076616C7565          type='hidden' name='atok' value
2048: 3D22396233663939356335396236323963353364346539386461653032663763          ="9b3f995c59b629c53d4e98dae 2f7c
2080: 6433223E0A202020202020202020202020202020202020202020202020202020          d3">
2112: 2020202020202020203C6469762069643D2262696743616C6C73546F41637469          <div id="bigCallsToActi
2144: 6F6E2220636C6173733D2263656E7465726564223E0A20202020202020202020          on" class="centered">
2176: 2020202020202020202020202020202020202020202020202020202020203C73          <s
2208: 70616E20636C6173733D2262696743616C6C73546F416374696F6E2D6974656D          pan class="bigCallsToAction-item
2240: 223E0A2020202020202020202020202020202020202020202020202020202020          ">
2272: 2020202020202020202020202020203C7370616E20636C6173733D2263616C6C          <span class="call
2304: 546F416374696F6E2063616C6C546F416374696F6E2D626967223E0A20202020          ToAction callToAction-big">
2336: 2020202020202020202020202020202020202020202020202020202020202020         
2368: 2020202020202020202020203C696E70757420636C6173733D2263616C6C546F          <input class="callTo
2400: 416374696F6E2D696E7075742220747970653D277375626D697427206E616D65          Action-input" type='submit' name
2432: 3D22627970617373222076616C75653D224469736D6973732074686973207761          ="bypass" value="Dismiss this wa
2464: 726E696E67223E0A202020202020202020202020202020202020202020202020          rning">
2496: 2020202020202020202020202020202020202020202020203C7370616E3E3C2F          <span></
2528: 7370616E3E0A2020202020202020202020202020202020202020202020202020          span>
2560: 2020202020202020202020202020202020203C2F7370616E3E0A202020202020          </span>
2592: 2020202020202020202020202020202020202020202020202020202020202020         
2624: 20203C2F7370616E3E0A20202020202020202020202020202020202020202020          </span>
2656: 20202020202020202020202020203C2F6469763E0A2020202020202020202020          </div>
2688: 2020202020202020202020202020202020202020203C2F666F726D3E0A202020          </form>
2720: 202020202020202020202020202020202020202020202020203C2F6469763E0A          </div>
2752: 202020202020202020202020202020202020202020202020202020203C646976          <div
2784: 20636C6173733D22636C656172223E3C2F6469763E0A20202020202020202020          class="clear"></div>
2816: 20202020202020202020202020203C2F6469763E0A2020202020202020202020          </div>
2848: 202020202020202020202020203C64697620636C6173733D22726F77223E0A20          <div class="row">
2880: 2020202020202020202020202020202020202020202020202020203C68323E57          <h2>W
2912: 686174277320436C6F7564466C6172653F3C2F68323E0A202020202020202020          hat's CloudFlare?</h2>
2944: 202020202020202020202020202020202020203C703E54686973207765627369          <p>This websi
2976: 7465207573657320436C6F7564466C61726520696E206F7264657220746F2070          te uses CloudFlare in order to p
3008: 726F76696465206974732075736572207769746820612066617374657220616E          rovide its user with a faster an
3040: 64206D6F72652073656375726520696E7465726E657420746861742075736573          d more secure internet that uses
3072: 2074686520636F6C6C656374697665206B6E6F776C65646765206F6620746865          the collective knowledge of the
3104: 20496E7465726E657420746F206B65657020776562736974657320736166652E          Internet to keep websites safe.
3136: 3C2F703E0A2020202020202020202020202020202020202020202020203C2F64          </p> </d
3168: 69763E0A2020202020202020202020202020202020202020202020203C646976          iv> <div
3200: 20636C6173733D22726F772063656E7465726564206C617374223E0A20202020          class="row centered last">
3232: 2020202020202020202020202020202020202020202020203C6120687265663D          <a href=
3264: 22687474703A2F2F7777772E636C6F7564666C6172652E636F6D2F223E3C696D          "http://www.cloudflare.com/"><im
3296: 67207372633D222F63646E2D6367692F696D616765732F70686973682F636C6F          g src="/cdn-cgi/images/phish/clo
3328: 7564666C6172652E706E6722202F3E3C2F613E0A202020202020202020202020          udflare.png" /></a>
3360: 2020202020202020202020203C2F6469763E0A20202020202020202020202020          </div>
3392: 202020202020203C2F6469763E0A202020202020202020202020202020203C2F          </div> </
3424: 74643E0A2020202020202020202020203C2F74723E0A20202020202020203C2F          td> </tr> </
3456: 7461626C653E0A202020203C2F626F64793E0A3C2F68746D6C3E0A          table> </body> </html>