from mushawe.yoafrica.com ([196.44.176.11])
	by gwayi.yoafrica.com with esmtp (Exim 4.90_1 (FreeBSD))
	(envelope-from <Brand-Response@cscglobal.com>)
	id 1kAfJw-000AK3-Tz
	for dnsadmin@yoafrica.com; Tue, 25 Aug 2020 22:13:28 +0200

from smtp6.utande.co.zw ([196.43.100.36]:56738)
	by mushawe.yoafrica.com with esmtp (Exim 4.90_1)
	id 1kAflH-0000rL-KY
	for dnsadmin@yoafrica.com; Tue, 25 Aug 2020 22:41:43 +0200

from insiza.utande.co.zw ([196.43.100.65]:22819)
	by smtp6.utande.co.zw with esmtp (Exim 4.92)
	id 1kAfls-0002ZB-B0
	for dnsadmin@yoafrica.com; Tue, 25 Aug 2020 22:42:20 +0200

from localhost (localhost [127.0.0.1])
	by insiza.utande.co.zw (Postfix) with ESMTP id 3506D4F9BFF
	for <dnsadmin@yoafrica.com>; Tue, 25 Aug 2020 22:42:02 +0200 (CAT)

No, score=2.276 tagged_above=-999 required=5
	tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, HTML_MIME_NO_HTML_TAG=0.377,
	HTML_NONELEMENT_30_40=0.001, MIME_HTML_ONLY=0.1,
	RCVD_IN_DNSWL_MED=-2.3, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001,
	URI_WP_DIRINDEX=3.499, URI_WP_HACKED_2=2.5]
	autolearn=no autolearn_force=no

from insiza.utande.co.zw (localhost [127.0.0.1])
	by insiza.utande.co.zw (Postfix) with ESMTP id C23074F9BDA
	for <dnsadmin@yoafrica.com>; Tue, 25 Aug 2020 22:41:54 +0200 (CAT)

insiza.utande.co.zw;
        spf=pass smtp.mailfrom=Brand-Response@cscglobal.com
          smtp.helo=externalmail.cscinfo.com

pass
        (cscglobal.com: 165.160.32.78 is authorized to use 'Brand-Response@cscglobal.com' in 'mfrom' identity (mechanism 'ip4:165.160.32.0/24' matched))
        receiver=insiza.utande.co.zw;
        identity=mailfrom;
        envelope-from="Brand-Response@cscglobal.com";
        helo=externalmail.cscinfo.com;
        client-ip=165.160.32.78

delayed 320 seconds at insiza.utande.co.zw, Tue, 25 Aug 2020 22:41:51 CAT

from externalmail.cscinfo.com (externalmail.cscinfo.com [165.160.32.78])
	by insiza.utande.co.zw (Postfix) with ESMTPS id 36D624F9BC5
	for <dnsadmin@yoafrica.com>; Tue, 25 Aug 2020 22:41:51 +0200 (CAT)

from localhost (localhost.localdomain [127.0.0.1])
	by externalmail.cscinfo.com (Postfix) with ESMTP id DAC3311DF608
	for <dnsadmin@yoafrica.com>; Tue, 25 Aug 2020 16:36:50 -0400 (EDT)

from externalmail.cscinfo.com ([127.0.0.1])
	by localhost (plmail04.wil.csc.local [127.0.0.1]) (amavisd-new, port 10024)
	with ESMTP id 78tW9ppS0ZeT; Tue, 25 Aug 2020 16:36:50 -0400 (EDT)

from pltcnemo01.wil.csc.local (pltcnemo01.wil.csc.local [10.98.145.70])
	by externalmail.cscinfo.com (Postfix) with ESMTP id BE0F311DF602;
	Tue, 25 Aug 2020 16:36:50 -0400 (EDT)

[120043247] Fraudulent and Malicious Activity using Email Account:
 peterm@cranridpetroleum.co.zw

<pre style=3D"font-family: helvetica, arial, verdana, sans-serif; font-size=
: 13px;"><font style=3D"font-family: &quot;Calibri&quot;, Arial, sans-serif=
 ;font-size: 14px;"><font style=3D"color:blue;font-weight:bold">To Whom It =
May Concern</font>,

CSC Digital Brand Services has been informed that there is currently an ema=
il account that is involved in a malicious scheme and sending emails to the=
 employees of <font style=3D"color:blue;font-weight:bold">Prosperity Bank</=
font>. CSC Digital Brand Services has received numerous complaints and e-ma=
ils regarding the email account listed below:=20

<font style=3D"color:blue;font-weight:bold">peterm@cranridpetroleum.co.zw</=
font>

Following is the email body and header information in the form of evidence:=
</font></pre><pre style=3D"font-family: helvetica, arial, verdana, sans-ser=
if; font-size: 13px;"><font style=3D"font-family: &quot;Calibri&quot;, Aria=
l, sans-serif ;font-size: 14px;">From: 'Tommie Haverland (158)' [mailto:pet=
erm@cranridpetroleum.co.zw]<br style=3D"box-sizing: border-box; font-family=
: helvetica, arial, verdana, sans-serif; font-size: 13px; white-space: norm=
al;"><span style=3D"font-family: helvetica, arial, verdana, sans-serif; fon=
t-size: 13px; white-space: normal;">Sent: Tuesday, August 18, 2020 12:46 AM=
</span><br style=3D"box-sizing: border-box; font-family: helvetica, arial, =
verdana, sans-serif; font-size: 13px; white-space: normal;"><span style=3D"=
font-family: helvetica, arial, verdana, sans-serif; font-size: 13px; white-=
space: normal;">To: Roxanna Salinas (92)</span><roxanna.salinas@prosperityb=
ankusa.com style=3D"box-sizing: border-box; font-family: helvetica, arial, =
verdana, sans-serif; font-size: 13px; white-space: normal;"><br style=3D"bo=
x-sizing: border-box;">Subject: Payment receipt for invoice<br style=3D"box=
-sizing: border-box;"><br style=3D"box-sizing: border-box;"><br style=3D"bo=
x-sizing: border-box;">Here is the invoice you requested. Please let me kno=
w if there is anything else I can help you with.<br style=3D"box-sizing: bo=
rder-box;"><br style=3D"box-sizing: border-box;">https://www.fedaicoskun.co=
m/wp-includes/personal_box/corporate_922662391954_hwzzni8qLQ0M/30517375_eFZ=
Tx/<br style=3D"box-sizing: border-box;">Best regards,<br style=3D"box-sizi=
ng: border-box;"><br style=3D"box-sizing: border-box;"><br style=3D"box-siz=
ing: border-box;">'Tommie Haverland (158)'<br style=3D"box-sizing: border-b=
ox;">Tommie.Haverland@prosperitybankusa.com<br style=3D"box-sizing: border-=
box;"><br style=3D"box-sizing: border-box;">-----Original Message-----<br s=
tyle=3D"box-sizing: border-box;"><br style=3D"box-sizing: border-box;">Sent=
: Monday, 04-24-2020 15:15<br style=3D"box-sizing: border-box;">From: "Roxa=
nna Salinas (92)" [mailto:Roxanna.Salinas@prosperitybankusa.com]<br style=
=3D"box-sizing: border-box;">To: "'Tommie Haverland (158)'"<br style=3D"box=
-sizing: border-box;">Importance: High<br style=3D"box-sizing: border-box;"=
>Subject: Aw: 'Tommie Haverland (158)' ...........</roxanna.salinas@prosper=
itybankusa.com></font></pre><pre style=3D""><font size=3D"4">Header Informa=
tion:</font></pre><pre style=3D"">X-ASG-Debug-ID: 1597691756-0e003853361a14=
c60001-Pxf0Ie<br style=3D"box-sizing: border-box; font-family: helvetica, a=
rial, verdana, sans-serif; font-size: 13px; white-space: normal;"><span sty=
le=3D"font-family: helvetica, arial, verdana, sans-serif; font-size: 13px; =
white-space: normal;">Received: from zwsmtp0.yoafrica.com (smtp2.yoafrica.c=
om [41.190.32.15]) by mx1.prosperitybankusa.com with ESMTP id ITuEN2gc7tuV0=
Ajo (version=3DTLSv1.2 cipher=3DECDHE-RSA-AES256-GCM-SHA384 bits=3D256 veri=
fy=3DNO) for&nbsp;</span><roxanna.salinas@prosperitybankusa.com style=3D"bo=
x-sizing: border-box; font-family: helvetica, arial, verdana, sans-serif; f=
ont-size: 13px; white-space: normal;">; Mon, 17 Aug 2020 14:15:58 -0500 (CD=
T)<br style=3D"box-sizing: border-box;">X-Barracuda-Envelope-From: peterm@c=
ranridpetroleum.co.zw<br style=3D"box-sizing: border-box;">X-Barracuda-Effe=
ctive-Source-IP: smtp2.yoafrica.com[41.190.32.15]<br style=3D"box-sizing: b=
order-box;">X-Barracuda-Apparent-Source-IP: 41.190.32.15<br style=3D"box-si=
zing: border-box;">X-Barracuda-UID:roxanna.salinas@prosperitybankusa.com Ro=
xanna.Salinas Roxanna.Salinas@prosperitybankusa.com<br style=3D"box-sizing:=
 border-box;">Received: from runde.yoafrica.com ([196.44.176.6])<br style=
=3D"box-sizing: border-box;">by zwsmtp0.yoafrica.com with esmtps (TLSv1.2:E=
CDHE-RSA-AES256-GCM-SHA384:256)<br style=3D"box-sizing: border-box;">(Exim =
4.90_1 (FreeBSD))<br style=3D"box-sizing: border-box;">(envelope-from&nbsp;=
<peterm@cranridpetroleum.co.zw style=3D"box-sizing: border-box;">)<br style=
=3D"box-sizing: border-box;">id 1k7kXU-000LpH-ML<br style=3D"box-sizing: bo=
rder-box;">for Roxanna.Salinas@prosperitybankusa.com; Mon, 17 Aug 2020 21:1=
1:24 +0200<br style=3D"box-sizing: border-box;">Received: from pc-62-19-104=
-200.cm.vtr.net ([200.104.19.62]:60992)<br style=3D"box-sizing: border-box;=
">by runde.yoafrica.com with esmtpsa (TLSv1.2:ECDHE-RSA-AES256-GCM-SHA384:2=
56)<br style=3D"box-sizing: border-box;">(Exim 4.90_1 (FreeBSD))<br style=
=3D"box-sizing: border-box;">(envelope-from&nbsp;<peterm@cranridpetroleum.c=
o.zw style=3D"box-sizing: border-box;">)<br style=3D"box-sizing: border-box=
;">id 1k7k6f-000NOd-RZ<br style=3D"box-sizing: border-box;">for Roxanna.Sal=
inas@prosperitybankusa.com; Mon, 17 Aug 2020 20:43:42 +0200<br style=3D"box=
-sizing: border-box;">Date: Mon, 17 Aug 2020 15:15:47 -0400<br style=3D"box=
-sizing: border-box;">From: "'Tommie Haverland (158)'"<peterm@cranridpetrol=
eum.co.zw style=3D"box-sizing: border-box;"><br style=3D"box-sizing: border=
-box;">To: "Roxanna Salinas (92)"<roxanna.salinas@prosperitybankusa.com sty=
le=3D"box-sizing: border-box;"><br style=3D"box-sizing: border-box;">Subjec=
t: Payment receipt for invoice<br style=3D"box-sizing: border-box;">MIME-Ve=
rsion: 1.0<br style=3D"box-sizing: border-box;">X-ASG-Orig-Subj: Payment re=
ceipt for invoice<br style=3D"box-sizing: border-box;">Content-Type: multip=
art/alternative; boundary=3D"----=3D_Part_14881_1130234664.3320898449367010=
2086"<br style=3D"box-sizing: border-box;">Message-Id:<e1k7kxu-000lph-ml@zw=
smtp0.yoafrica.com style=3D"box-sizing: border-box;"><br style=3D"box-sizin=
g: border-box;">X-Barracuda-Connect: smtp2.yoafrica.com[41.190.32.15]<br st=
yle=3D"box-sizing: border-box;">X-Barracuda-Start-Time: 1597691757<br style=
=3D"box-sizing: border-box;">X-Barracuda-Encrypted: ECDHE-RSA-AES256-GCM-SH=
A384<br style=3D"box-sizing: border-box;">X-Barracuda-URL: https://SL-Barra=
cudaSPAM01:443/cgi-mod/mark.cgi<br style=3D"box-sizing: border-box;">X-Viru=
s-Scanned: by bsmtpd at prosperitybankusa.com<br style=3D"box-sizing: borde=
r-box;">X-Barracuda-Scan-Msg-Size: 1846<br style=3D"box-sizing: border-box;=
">X-Barracuda-BRTS-Status: 1<br style=3D"box-sizing: border-box;">X-Barracu=
da-BRTS-Evidence: fedaicoskun.com<br style=3D"box-sizing: border-box;">X-Ba=
rracuda-Bayes: INNOCENT GLOBAL 0.4853 1.0000 0.0000<br style=3D"box-sizing:=
 border-box;">X-Barracuda-Spam-Score: 2.50<br style=3D"box-sizing: border-b=
ox;">X-Barracuda-Spam-Status: No, SCORE=3D2.50 using global scores of TAG_L=
EVEL=3D3.0 QUARANTINE_LEVEL=3D4.0 KILL_LEVEL=3D5.0 tests=3DBSF_SC7_MV1009, =
HTML_MESSAGE<br style=3D"box-sizing: border-box;">X-Barracuda-Spam-Report: =
Code version 3.2, rules version 3.2.3.83967<br style=3D"box-sizing: border-=
box;">Rule breakdown below<br style=3D"box-sizing: border-box;">pts rule na=
me description<br style=3D"box-sizing: border-box;">---- ------------------=
---- --------------------------------------------------<br style=3D"box-siz=
ing: border-box;">0.00 HTML_MESSAGE BODY: HTML included in message<br style=
=3D"box-sizing: border-box;">2.50 BSF_SC7_MV1009 Custom rule MV1009</e1k7kx=
u-000lph-ml@zwsmtp0.yoafrica.com></roxanna.salinas@prosperitybankusa.com></=
peterm@cranridpetroleum.co.zw></peterm@cranridpetroleum.co.zw></peterm@cran=
ridpetroleum.co.zw></roxanna.salinas@prosperitybankusa.com><font size=3D"4"=
><br></font></pre><pre style=3D""><font style=3D"">

<font size=3D"4">On behalf of</font> <font style=3D"font-family: Calibri, A=
rial, sans-serif; font-size: 14px; color: blue; font-weight: bold;">Prosper=
ity Bank</font><font face=3D"Calibri, Arial, sans-serif"><span style=3D"fon=
t-size: 14px;">, CSC Digital Brand Services requests that the e-mail addres=
s listed above be deactivated immediately. </span></font><font style=3D"fon=
t-family: Calibri, Arial, sans-serif; font-size: 14px; color: blue; font-we=
ight: bold;">Prosperity Bank</font><font face=3D"Calibri, Arial, sans-serif=
"><span style=3D"font-size: 14px;"> would like you to provide CSC Digital B=
rand Services with any e-mail messages which may contain customer data. Thi=
s information will be forwarded to </span></font><font style=3D"font-family=
: Calibri, Arial, sans-serif; font-size: 14px; color: blue; font-weight: bo=
ld;">Prosperity Bank</font><font face=3D"Calibri, Arial, sans-serif"><span =
style=3D"font-size: 14px;"> so that they may notify their customers regardi=
ng this issue and take other appropriate actions as needed.

Please contact us if any further information is required to expedite the pr=
ocess of removing this e-mail address from service.  If needed, forward thi=
s e-mail and request to the appropriate contact that is able to deactivate =
this e-mail address.=20

Thank you for your time and consideration.

</span></font><font style=3D"font-family: Calibri, Arial, sans-serif; font-=
size: 14px; color: blue; font-weight: bold;">Zia Rahman</font><font face=3D=
"Calibri, Arial, sans-serif"><span style=3D"font-size: 14px;">
Global Security Response Team
size: 14px; color: black; font-weight: bold;">24x7 GSRT: </font><font face=
=3D"Calibri, Arial, sans-serif"><span style=3D"font-size: 14px;">+186688070=
25
size: 14px; color: black; font-weight: bold;">24x7 GSRT Intl: </font><font =
face=3D"Calibri, Arial, sans-serif"><span style=3D"font-size: 14px;">+14084=
777706
size: 14px; color: blue; font-style: italic;">Phishing-Response@cscglobal.c=
om</font><font face=3D"Calibri, Arial, sans-serif"><span style=3D"font-size=
: 14px;">

size: 14px; color: black; font-weight: bold;">CSC=C2=AE</font><font face=3D=
</span></font><a href=3D"http://cscglobal.com/" style=3D"font-family: Calib=
ri, Arial, sans-serif; font-size: 14px; color: blue;">cscglobal.com</a><fon=
t face=3D"Calibri, Arial, sans-serif"><span style=3D"font-size: 14px;">
size: 14px; color: black; font-weight: bold; font-style: italic;">We are th=
e business behind business</font><font face=3D"Calibri, Arial, sans-serif">=
<span style=3D"font-size: 14px;">
---------------------------------------------------------------------------=
---
What is Phishing? Phishing attacks use 'spoofed' e-mails and fraudulent web=
sites designed to fool recipients into divulging personal financial data su=
ch as credit card numbers, account usernames and passwords, social security=
 numbers, etc. By hijacking the trusted brands of well-known banks, online =
retailers and credit card companies, phishers are able to convince up to 5%=
 of recipients to respond to them.

=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D
Electronic Privacy Notice. This e-mail, and any attachments, contains infor=
mation that is, or may be, covered by the Electronic Communications Privacy=
 Act, 18 U.S.C. 2510-2521, and is also confidential and proprietary in natu=
re. If you are not the intended recipient, please be advised that you are l=
egally prohibited from retaining, using, copying, distributing, or otherwis=
e disclosing this information in any manner. Instead, please reply to the s=
ender that you have received this communication in error, and then immediat=
ely delete it. Thank you in advance for your cooperation.
=3D=3D=3D</span></font></font></pre>