from tashayar.mail.utande.co.zw ([196.29.32.27] helo=tashayar.utande.co.zw)
	by gwayi.yoafrica.com with esmtp (Exim 4.90_1 (FreeBSD))
	(envelope-from <shingirai.matare@dandemutande.co.zw>)
	id 1k3WwF-000Fwc-En
	for abuse@yoafrica.com; Thu, 06 Aug 2020 05:51:31 +0200

from [172.24.1.99] (port=59138 helo=mail.dandemutande.co.zw)
	by tashayar.utande.co.zw with esmtps (TLSv1.2:ECDHE-RSA-AES256-GCM-SHA384:256)
	(Exim 4.90_1)
	id 1k3X4o-0000pH-B6
	for abuse@yoafrica.com; Thu, 06 Aug 2020 06:00:22 +0200

from DESKTOP1A8JKG2 (smtp8.utande.co.zw [196.43.100.38])
	by mail.dandemutande.co.zw (Postfix) with ESMTPA id 2615678F8ABA
	for <abuse@yoafrica.com>; Thu,  6 Aug 2020 06:01:56 +0200 (CAT)

"'PhishLabs Security Operations'" <soc@phishlabs.com>,
	<support@yoafrica.com>,
	<abuse@yoafrica.com>,
	<eig-digest@phishlabs.com>

ZIM679005 RE: [PL-1784775] Phishing attack(s) hosted on: turntcovert.com

Good day Team

I hope you well. Please note that the above Is not being hosted by us.

dig MX turntcovert.com

; <<>> DiG 9.11.3 <<>> MX turntcovert.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 39936
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
; COOKIE: 174aae8a43e0640410d49ece5f2b7e8ba43e5929ebc1b319 (good)
;; QUESTION SECTION:
;turntcovert.com.               IN      MX

;; AUTHORITY SECTION:
turntcovert.com.        360     IN      SOA     ns7.alidns.com. =
hostmaster.hichina.com. 2020062002 3600 1200 86400 360

;; Query time: 1260 msec
;; SERVER: 196.44.176.1#53(196.44.176.1)
;; WHEN: Thu Aug 06 05:52:43 CAT 2020
;; MSG SIZE  rcvd: 138

dig NS turntcovert.com

; <<>> DiG 9.11.3 <<>> NS turntcovert.com
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 4506
;; flags: qr rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 1

; COOKIE: 8c8068249692d78af771cac05f2b7f01ea2969bef993936b (good)
;turntcovert.com.               IN      NS

;; ANSWER SECTION:
turntcovert.com.        84737   IN      NS      ns7.alidns.com.
turntcovert.com.        84737   IN      NS      ns8.alidns.com.

dig A turntcovert.com

; <<>> DiG 9.11.3 <<>> A turntcovert.com
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 63160
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 2, ADDITIONAL: 1

; COOKIE: b5e8544ba1bf79583b65e4fc5f2b7f5b1d48512f5db24c97 (good)
;turntcovert.com.               IN      A

turntcovert.com.        555     IN      A       162.241.117.122

turntcovert.com.        84647   IN      NS      ns8.alidns.com.
turntcovert.com.        84647   IN      NS      ns7.alidns.com.

Thank you.

Regards,

Shingirai I. Matare
Network Support Engineer
Dandemutande Investments (Pvt.) Ltd
Office: (+263) 4 707 533
Extension: 4051
Skype:shingirai.matare
www.dandemutande.co.zw |=20

-----Original Message-----
From: PhishLabs Security Operations [mailto:soc@phishlabs.com]=20
Sent: 06 August 2020 03:37
To: support@yoafrica.com; abuse@yoafrica.com; eig-digest@phishlabs.com
Subject: [PL-1784775] Phishing attack(s) hosted on: turntcovert.com

During an investigation of fraud, we discovered a compromised website =
(turntcovert.com) that is being used to attack our client and their =
customers.

In addition to the website owner, we have addressed this report to the =
responsible authoritative providers who have the ability to disable the =
malicious content in question. Based on your relationship to the content =
in question, please see our specific request below.

This threat has been active for at least 0.4 hours.

hXXps://turntcovert.com/w3llscaptcha/dashboard
hXXps://turntcovert.com/w3llscaptcha/dashboard/2.php
hXXps://turntcovert.com/w3llscaptcha/dashboard/login.php?7475726e74636f76=
6572742e636f6d7475726e74636f766572742e636f6d7475726e74636f766572742e636f6=
d7475726e74636f766572742e636f6d=3D
hXXps://turntcovert.com/w3llscaptcha/dashboard/

First detection of malicious activity: 08-06-2020 01:13:11 UTC Most =
recent observation of malicious activity: 08-06-2020 01:36:32 UTC =
Associated IP Addresses:
162.241.117.122

=3D=3D=3D   HOSTING  PROVIDER   =3D=3D=3D
If you agree that this is malicious, we kindly request that you take =
steps to have the content removed as soon as possible.  It is highly =
likely that the intruder who set up this phishing content has also left =
additional fraudulent material on this server such as illegitimate =
access points.

=3D=3D=3D     WEBSITE OWNER     =3D=3D=3D
We recommend taking the following actions to secure the web site and =
prevent the attackers from returning:
    - Update your web applications including CMS, blog, ecommerce, and =
other applications (and all add-on modules/components/plugins).
    - Search all of your web directories for suspicious files as =
attackers commonly leave backdoors.
    - Scan the computer from which you login to your web hosting control =
panel or ftp server with anti-virus software.=20
    - Change your web hosting provider if this is an ongoing issue.

If your provider has disabled your account because of this incident, you =
must coordinate a resolution with them directly as PhishLabs has no =
control over this aspect.

If we have contacted you in error, or if there is a better way for us to =
report this incident, please let us know so that we may continue our =
investigation.

We are grateful for your assistance. =20

Kind regards,
SOC Team
PhishLabs Security Operations
12023866001
Available 24/7

[PL-1784775]=20

From shingirai.matare@dandemutande.co.zw Thu Aug 06 05:51:31 2020