from mushawe.yoafrica.com ([196.44.176.11])
	by gwayi.yoafrica.com with esmtp (Exim 4.90_1 (FreeBSD))
	(envelope-from <soc@phishlabs.com>)
	id 1ju5lA-0005SS-Er
	for dnsadmin@yoafrica.com; Sat, 11 Jul 2020 05:01:04 +0200

from [41.190.32.2] (port=61773 helo=sengwe.utande.co.zw)
	by mushawe.yoafrica.com with esmtp (Exim 4.90_1)
	id 1ju6em-0001Ix-Ea
	for dnsadmin@yoafrica.com; Sat, 11 Jul 2020 05:58:32 +0200

from localhost (localhost [127.0.0.1])
	by sengwe.utande.co.zw (Postfix) with ESMTP id 89F347A6638
	for <dnsadmin@yoafrica.com>; Sat, 11 Jul 2020 05:51:04 +0200 (CAT)

No, score=0.7 tagged_above=-999 required=5 tests=[BAYES_50=0.8,
	SPF_HELO_NONE=0.001, SPF_PASS=-0.001, ST_P0F_Linux=-0.1]
	autolearn=ham autolearn_force=no

from sengwe.utande.co.zw (localhost [127.0.0.1])
	by sengwe.utande.co.zw (Postfix) with ESMTP id E1E0C7A662F
	for <dnsadmin@yoafrica.com>; Sat, 11 Jul 2020 05:50:59 +0200 (CAT)

sengwe.utande.co.zw;
        spf=pass smtp.mailfrom=soc@phishlabs.com
          smtp.helo=mtsapi1.phishlabs.com

pass
        (phishlabs.com: 52.71.51.126 is authorized to use 'soc@phishlabs.com' in 'mfrom' identity (mechanism 'ip4:52.71.51.126' matched))
        receiver=sengwe.utande.co.zw;
        identity=mailfrom;
        envelope-from="soc@phishlabs.com";
        helo=mtsapi1.phishlabs.com;
        client-ip=52.71.51.126

delayed 448 seconds at sengwe.utande.co.zw, Sat, 11 Jul 2020 05:50:57 CAT

from mtsapi1.phishlabs.com (mtsapi1.phishlabs.com [52.71.51.126])
	by sengwe.utande.co.zw (Postfix) with ESMTPS id BF1C17A665C
	for <dnsadmin@yoafrica.com>; Sat, 11 Jul 2020 05:50:56 +0200 (CAT)

	by mtsapi1.phishlabs.com (8.14.4/8.14.4) with ESMTP id 06B3pTie001137;
	Sat, 11 Jul 2020 03:51:30 GMT

During an investigation of fraud, we discovered a compromised website (www.=
truworths.co.zw) that is being used to attack our client and their customer=
s.

In addition to the website owner, we have addressed this report to the resp=
onsible authoritative providers who have the ability to disable the malicio=
us content in question. Based on your relationship to the content in questi=
on, please see our specific request below.

This threat has been active for at least 0.8 hours.

hXXp://www.truworths.co.zw/logancee/modules/menu/chcaptcha/index.php
hXXp://www.truworths.co.zw/logancee/modules/menu/chcaptcha/dashboard/info.p=
hp
hXXp://www.truworths.co.zw/logancee/modules/menu/chcaptcha/dashboard/info1.=
php
hXXp://www.truworths.co.zw/logancee/modules/menu/chcaptcha/dashboard/login.=
php

First detection of malicious activity: 07-11-2020 02:59:35 UTC
Most recent observation of malicious activity: 07-11-2020 03:49:34 UTC
Associated IP Addresses:
41.191.238.186

=3D=3D=3D   HOSTING  PROVIDER   =3D=3D=3D
If you agree that this is malicious, we kindly request that you take steps =
to have the content removed as soon as possible.  It is highly likely that =
the intruder who set up this phishing content has also left additional frau=
dulent material on this server such as illegitimate access points.

=3D=3D=3D     WEBSITE OWNER     =3D=3D=3D
We recommend taking the following actions to secure the web site and preven=
t the attackers from returning:
    - Update your web applications including CMS, blog, ecommerce, and othe=
r applications (and all add-on modules/components/plugins).
    - Search all of your web directories for suspicious files as attackers =
commonly leave backdoors.
    - Scan the computer from which you login to your web hosting control pa=
nel or ftp server with anti-virus software.=20
    - Change your web hosting provider if this is an ongoing issue.

If your provider has disabled your account because of this incident, you mu=
st coordinate a resolution with them directly as PhishLabs has no control o=
ver this aspect.

If we have contacted you in error, or if there is a better way for us to re=
port this incident, please let us know so that we may continue our investig=
ation.

We are grateful for your assistance. =20

Kind regards, =20
SOC Team
PhishLabs Security Operations
12023866001
Available 24/7

[PL-1749685]=20