from mushawe.yoafrica.com ([196.44.176.11])
	by gwayi.yoafrica.com with esmtp (Exim 4.90_1 (FreeBSD))
	(envelope-from <soc@phishlabs.com>)
	id 1jxUPG-000IwT-GO; Mon, 20 Jul 2020 13:56:30 +0200

from [41.190.32.2] (port=54000 helo=sengwe.utande.co.zw)
	by mushawe.yoafrica.com with esmtp (Exim 4.90_1)
	id 1jxURR-0004iW-NY; Mon, 20 Jul 2020 13:58:45 +0200

from localhost (localhost [127.0.0.1])
	by sengwe.utande.co.zw (Postfix) with ESMTP id B6D457A663F;
	Mon, 20 Jul 2020 13:51:01 +0200 (CAT)

No, score=-0.35 tagged_above=-999 required=5
	tests=[BAYES_05=-0.5, KAM_LOTSOFHASH=0.25, SPF_HELO_NONE=0.001,
	SPF_PASS=-0.001, ST_P0F_Linux=-0.1] autolearn=no autolearn_force=no

from sengwe.utande.co.zw (localhost [127.0.0.1])
	by sengwe.utande.co.zw (Postfix) with ESMTP id 8E1747A6636;
	Mon, 20 Jul 2020 13:50:57 +0200 (CAT)

sengwe.utande.co.zw;
        spf=pass smtp.mailfrom=soc@phishlabs.com
          smtp.helo=mtsapi2.phishlabs.com

pass
        (phishlabs.com: 34.200.132.149 is authorized to use 'soc@phishlabs.com' in 'mfrom' identity (mechanism 'ip4:34.200.132.149' matched))
        receiver=sengwe.utande.co.zw;
        identity=mailfrom;
        envelope-from="soc@phishlabs.com";
        helo=mtsapi2.phishlabs.com;
        client-ip=34.200.132.149

from mtsapi2.phishlabs.com (mtsapi2.phishlabs.com [34.200.132.149])
	by sengwe.utande.co.zw (Postfix) with ESMTPS id EDC067A662F;
	Mon, 20 Jul 2020 13:50:52 +0200 (CAT)

	by mtsapi2.phishlabs.com (8.14.4/8.14.4) with ESMTP id 06KBwfDZ012688;
	Mon, 20 Jul 2020 11:58:42 GMT

help@utande.co.zw, sales@utande.co.zw, abuse@yoafrica.com,
        support@yoafrica.com, dnsadmin@yoafrica.com

During an investigation of fraud, we discovered a compromised website (www.=
truworths.co.zw) that is being used to attack our client and their customer=
s.

In addition to the website owner, we have addressed this report to the resp=
onsible authoritative providers who have the ability to disable the malicio=
us content in question. Based on your relationship to the content in questi=
on, please see our specific request below.

This threat has been active for at least 117.8 hours.

hXXps://www.truworths.co.zw/logancee/modules/menu/Century%20Online/century/=
info/ElPSYCHO/action.html
info/ElPSYCHO/action.html?session=3D%24host%24host%24host%24host%24host%24h=
ost%24host%24host&template=3DInitiate&valid=3Dtrue
info/ElPSYCHO/
info/ElPSYCHO
info/ElPSYCHO/3.html
info/ElPSYCHO/3.html?83bf027c4ca48ef750e1ead872d859ac-83bf027c4ca48ef750e1e=
ad872d859ac-83bf027c4ca48ef750e1ead872d859ac83bf027c4ca48ef750e1ead872d859a=
c83bf027c4ca48ef750e1ead872d859ac83bf027c4ca48ef750e1ead872d859ac83bf027c4c=
a48ef750e1ead872d859ac83bf027c4ca48ef750e1ead872d859ac83bf027c4ca48ef750e1e=
ad872d859ac83bf027c4ca48ef750e1ead872d859ac83bf027c4ca48ef750e1ead872d859ac=
=3D

First detection of malicious activity: 07-15-2020 14:06:04 UTC
Most recent observation of malicious activity: 07-20-2020 11:52:05 UTC
Associated IP Addresses:
41.191.238.186

=3D=3D=3D   HOSTING  PROVIDER   =3D=3D=3D
If you agree that this is malicious, we kindly request that you take steps =
to have the content removed as soon as possible.  It is highly likely that =
the intruder who set up this phishing content has also left additional frau=
dulent material on this server such as illegitimate access points.

=3D=3D=3D     WEBSITE OWNER     =3D=3D=3D
We recommend taking the following actions to secure the web site and preven=
t the attackers from returning:
    - Update your web applications including CMS, blog, ecommerce, and othe=
r applications (and all add-on modules/components/plugins).
    - Search all of your web directories for suspicious files as attackers =
commonly leave backdoors.
    - Scan the computer from which you login to your web hosting control pa=
nel or ftp server with anti-virus software.=20
    - Change your web hosting provider if this is an ongoing issue.

If your provider has disabled your account because of this incident, you mu=
st coordinate a resolution with them directly as PhishLabs has no control o=
ver this aspect.

If we have contacted you in error, or if there is a better way for us to re=
port this incident, please let us know so that we may continue our investig=
ation.

We are grateful for your assistance. =20

Kind regards, =20
SOC Team
PhishLabs Security Operations
12023866001
Available 24/7

[PL-1758193]=20