from mushawe.yoafrica.com ([196.44.176.11])
	by gwayi.yoafrica.com with esmtps (TLSv1.2:ECDHE-RSA-AES256-GCM-SHA384:256)
	(Exim 4.90_1 (FreeBSD))
	(envelope-from <urlhaus-notify@abuse.ch>)
	id 1g7zJ9-000Okm-TP
	for abuse@yoafrica.com; Thu, 04 Oct 2018 10:48:31 +0200

from gairezi.yoafrica.com ([196.44.176.14]:38006)
	by mushawe.yoafrica.com with esmtp (Exim 4.90_1)
	id 1g7zQE-0000wl-Oc
	for abuse@yoafrica.com; Thu, 04 Oct 2018 10:55:50 +0200

from localhost (localhost [127.0.0.1])
	by gairezi.yoafrica.com (Postfix) with ESMTP id CE4122E80FF
	for <abuse@yoafrica.com>; Thu,  4 Oct 2018 10:49:38 +0200 (CAT)

No, score=4.8 tagged_above=-999 required=5 tests=[BAYES_50=0.8,
	DKIM_ADSP_ALL=0.8, KAM_ASCII_DIVIDERS=0.8, KAM_NUMSUBJECT=0.5,
	RCVD_IN_DNSWL_MED=0.001, SPF_PASS=-0.001, ST_P0F_Linux=-0.1,
	URIBL_DBL_ABUSE_SPAM=2] autolearn=no autolearn_force=no

from gairezi.yoafrica.com (localhost [127.0.0.1])
	by gairezi.yoafrica.com (Postfix) with ESMTP id 8BF0D2E7844
	for <abuse@yoafrica.com>; Thu,  4 Oct 2018 10:49:33 +0200 (CAT)

pass (abuse.ch: 212.25.19.53 is authorized to use 'urlhaus-notify@abuse.ch' in 'mfrom' identity (mechanism 'mx' matched)) receiver=gairezi.yoafrica.com; identity=mailfrom; envelope-from="urlhaus-notify@abuse.ch"; helo=mail.abuse.ch; client-ip=212.25.19.53

from mail.abuse.ch (mail.abuse.ch [212.25.19.53])
	by gairezi.yoafrica.com (Postfix) with ESMTP id F318B2E784A
	for <abuse@yoafrica.com>; Thu,  4 Oct 2018 10:49:30 +0200 (CAT)

mail.abuse.ch; dkim=none reason="no signature";
	dkim-adsp=fail (unprotected policy); dkim-atps=neutral

[URLhaus] abuse report: malware distribution site(s) on 196.44.176.54

=================================================
= This message has been generated automatically =

Hello

You are receiving this email because your email address is recognized by Abuseix [1] as abuse-mail for the IP address 196.44.176.54.

This email has been generated automatically by URLhaus [2] to inform you about one or more malware distribution sites that are currently being hosted on 196.44.176.54:

* Host information
IP address: 196.44.176.54
Hostname:   changane.yoafrica.com
AS number:  31856
AS name:    CABS

* Malware URL(s)
URL:   hXXp://www[.]shockmedia.co.zw/71-255316632077925879539886200861.php
Proof: https://urlhaus.abuse.ch/url/64699

The said URLs are actively being used at the moment to distribute malware. I therefore kindly ask you to remove the said files at your earliest convenience to prevent that other internet users get infected with malware.

As the said website(s) have been likely compromised, you may also want to reset the customer's FTP account and make sure that any installed content management system (CMS) like WordPress, Typo3 or Joomla (including any 3rd party plugins) are up to date.

Should you have any question please do not hesitate to drop a line to: admin[at]abuse{dot}ch

Best regards,
abuse.ch 

[1] https://www.abusix.com/contactdb
[2] https://urlhaus.abuse.ch/