from mushawe.yoafrica.com ([196.44.176.11])
	by gwayi.yoafrica.com with esmtp (Exim 4.90_1 (FreeBSD))
	(envelope-from <soc@phishlabs.com>)
	id 1jvg2R-000ArG-Gp
	for dnsadmin@yoafrica.com; Wed, 15 Jul 2020 13:57:27 +0200

from [41.190.32.2] (port=32772 helo=sengwe.utande.co.zw)
	by mushawe.yoafrica.com with esmtp (Exim 4.90_1)
	id 1jvgz7-0003Jt-4b
	for dnsadmin@yoafrica.com; Wed, 15 Jul 2020 14:58:05 +0200

from localhost (localhost [127.0.0.1])
	by sengwe.utande.co.zw (Postfix) with ESMTP id B0C927A6688
	for <dnsadmin@yoafrica.com>; Wed, 15 Jul 2020 14:50:29 +0200 (CAT)

No, score=0.15 tagged_above=-999 required=5
	tests=[BAYES_20=-0.001, KAM_LOTSOFHASH=0.25, SPF_HELO_NONE=0.001,
	SPF_PASS=-0.001, ST_P0F_Linux=-0.1, URIBL_BLOCKED=0.001]
	autolearn=no autolearn_force=no

from sengwe.utande.co.zw (localhost [127.0.0.1])
	by sengwe.utande.co.zw (Postfix) with ESMTP id 1FEE27A6683
	for <dnsadmin@yoafrica.com>; Wed, 15 Jul 2020 14:50:25 +0200 (CAT)

sengwe.utande.co.zw;
        spf=pass smtp.mailfrom=soc@phishlabs.com
          smtp.helo=mtsapi2.phishlabs.com

pass
        (phishlabs.com: 34.200.132.149 is authorized to use 'soc@phishlabs.com' in 'mfrom' identity (mechanism 'ip4:34.200.132.149' matched))
        receiver=sengwe.utande.co.zw;
        identity=mailfrom;
        envelope-from="soc@phishlabs.com";
        helo=mtsapi2.phishlabs.com;
        client-ip=34.200.132.149

from mtsapi2.phishlabs.com (mtsapi2.phishlabs.com [34.200.132.149])
	by sengwe.utande.co.zw (Postfix) with ESMTPS id 342187A66DD
	for <dnsadmin@yoafrica.com>; Wed, 15 Jul 2020 14:50:20 +0200 (CAT)

	by mtsapi2.phishlabs.com (8.14.4/8.14.4) with ESMTP id 06FCwMaK014791;
	Wed, 15 Jul 2020 12:58:23 GMT

info@truworths.co.zw, christian.paupe@telecon.com, dnsadmin@yoafrica.com

During an investigation of fraud, we discovered a compromised website (www.=
truworths.co.zw) that is being used to attack our client and their customer=
s.

In addition to the website owner, we have addressed this report to the resp=
onsible authoritative providers who have the ability to disable the malicio=
us content in question. Based on your relationship to the content in questi=
on, please see our specific request below.

This threat has been active for at least 259.2 hours.

hXXp://www.truworths.co.zw/logancee/modules/locale/tests/translations/w3lls=
captcha/dashboard/
captcha/dashboard/login.php
captcha/dashboard/INFO.php
captcha/dashboard/2.php
captcha/dashboard/INFO.php?3ceb43237f0e310fea2361e2bc9c5770-3ceb43237f0e310=
fea2361e2bc9c5770-3ceb43237f0e310fea2361e2bc9c57703ceb43237f0e310fea2361e2b=
c9c57703ceb43237f0e310fea2361e2bc9c57703ceb43237f0e310fea2361e2bc9c57703ceb=
43237f0e310fea2361e2bc9c57703ceb43237f0e310fea2361e2bc9c57703ceb43237f0e310=
fea2361e2bc9c57703ceb43237f0e310fea2361e2bc9c57703ceb43237f0e310fea2361e2bc=
9c5770=3D
captcha/dashboard/2.php?38ab7720afb73df02f426d1a4f5f9069-38ab7720afb73df02f=
426d1a4f5f9069-38ab7720afb73df02f426d1a4f5f906938ab7720afb73df02f426d1a4f5f=
906938ab7720afb73df02f426d1a4f5f906938ab7720afb73df02f426d1a4f5f906938ab772=
0afb73df02f426d1a4f5f906938ab7720afb73df02f426d1a4f5f906938ab7720afb73df02f=
426d1a4f5f906938ab7720afb73df02f426d1a4f5f906938ab7720afb73df02f426d1a4f5f9=
069=3D
captcha/
captcha/dashboard/finish.php?e8161779ab762150b865401b6463ef6f-e8161779ab762=
150b865401b6463ef6f-e8161779ab762150b865401b6463ef6fe8161779ab762150b865401=
b6463ef6fe8161779ab762150b865401b6463ef6fe8161779ab762150b865401b6463ef6fe8=
161779ab762150b865401b6463ef6fe8161779ab762150b865401b6463ef6fe8161779ab762=
150b865401b6463ef6fe8161779ab762150b865401b6463ef6fe8161779ab762150b865401b=
6463ef6f=3D
captcha/dashboard/2.php?41b72057c87cb87f21f330396aa242b5-41b72057c87cb87f21=
f330396aa242b5-41b72057c87cb87f21f330396aa242b541b72057c87cb87f21f330396aa2=
42b541b72057c87cb87f21f330396aa242b541b72057c87cb87f21f330396aa242b541b7205=
7c87cb87f21f330396aa242b541b72057c87cb87f21f330396aa242b541b72057c87cb87f21=
f330396aa242b541b72057c87cb87f21f330396aa242b541b72057c87cb87f21f330396aa24=
2b5=3D
captcha/dashboard
captcha/dashboard/INFO.php?ba318a1342a9e00ef6d723d0d923f75e-ba318a1342a9e00=
ef6d723d0d923f75e-ba318a1342a9e00ef6d723d0d923f75eba318a1342a9e00ef6d723d0d=
923f75eba318a1342a9e00ef6d723d0d923f75eba318a1342a9e00ef6d723d0d923f75eba31=
8a1342a9e00ef6d723d0d923f75eba318a1342a9e00ef6d723d0d923f75eba318a1342a9e00=
ef6d723d0d923f75eba318a1342a9e00ef6d723d0d923f75eba318a1342a9e00ef6d723d0d9=
23f75e=3D
captcha/dashboard/login.php?7777772e747275776f727468732e636f2e7a777777772e7=
47275776f727468732e636f2e7a777777772e747275776f727468732e636f2e7a777777772e=
747275776f727468732e636f2e7a77=3D
captcha/dashboard/INFO.php?f26f090f4e6a4c20a75dff2b222ccb87-f26f090f4e6a4c2=
0a75dff2b222ccb87-f26f090f4e6a4c20a75dff2b222ccb87f26f090f4e6a4c20a75dff2b2=
22ccb87f26f090f4e6a4c20a75dff2b222ccb87f26f090f4e6a4c20a75dff2b222ccb87f26f=
090f4e6a4c20a75dff2b222ccb87f26f090f4e6a4c20a75dff2b222ccb87f26f090f4e6a4c2=
0a75dff2b222ccb87f26f090f4e6a4c20a75dff2b222ccb87f26f090f4e6a4c20a75dff2b22=
2ccb87=3D
captcha/dashboard/INFO.php?70e5ab6e19dbada1d304f78ecff7f2b0-70e5ab6e19dbada=
1d304f78ecff7f2b0-70e5ab6e19dbada1d304f78ecff7f2b070e5ab6e19dbada1d304f78ec=
ff7f2b070e5ab6e19dbada1d304f78ecff7f2b070e5ab6e19dbada1d304f78ecff7f2b070e5=
ab6e19dbada1d304f78ecff7f2b070e5ab6e19dbada1d304f78ecff7f2b070e5ab6e19dbada=
1d304f78ecff7f2b070e5ab6e19dbada1d304f78ecff7f2b070e5ab6e19dbada1d304f78ecf=
f7f2b0=3D

First detection of malicious activity: 07-04-2020 17:44:35 UTC
Most recent observation of malicious activity: 07-15-2020 12:56:59 UTC
Associated IP Addresses:
41.191.238.186

=3D=3D=3D   HOSTING  PROVIDER   =3D=3D=3D
If you agree that this is malicious, we kindly request that you take steps =
to have the content removed as soon as possible.  It is highly likely that =
the intruder who set up this phishing content has also left additional frau=
dulent material on this server such as illegitimate access points.

=3D=3D=3D     WEBSITE OWNER     =3D=3D=3D
We recommend taking the following actions to secure the web site and preven=
t the attackers from returning:
    - Update your web applications including CMS, blog, ecommerce, and othe=
r applications (and all add-on modules/components/plugins).
    - Search all of your web directories for suspicious files as attackers =
commonly leave backdoors.
    - Scan the computer from which you login to your web hosting control pa=
nel or ftp server with anti-virus software.=20
    - Change your web hosting provider if this is an ongoing issue.

If your provider has disabled your account because of this incident, you mu=
st coordinate a resolution with them directly as PhishLabs has no control o=
ver this aspect.

If we have contacted you in error, or if there is a better way for us to re=
port this incident, please let us know so that we may continue our investig=
ation.

We are grateful for your assistance. =20

Kind regards, =20
SOC Team
PhishLabs Security Operations
12023866001
Available 24/7

[PL-1747392]=20