from mushawe.yoafrica.com ([196.44.176.11])
	by gwayi.yoafrica.com with esmtp (Exim 4.90_1 (FreeBSD))
	(envelope-from <takedown-response+12950042@netcraft.com>)
	id 1kdNlZ-000Af7-5S
	for abuse@yoafrica.com; Fri, 13 Nov 2020 03:20:41 +0200

from [41.190.32.2] (port=12801 helo=sengwe.utande.co.zw)
	by mushawe.yoafrica.com with esmtp (Exim 4.90_1)
	id 1kdO4o-0006x6-B2
	for abuse@yoafrica.com; Fri, 13 Nov 2020 03:40:34 +0200

from localhost (localhost [127.0.0.1])
	by sengwe.utande.co.zw (Postfix) with ESMTP id 6BB4C7A4442
	for <abuse@yoafrica.com>; Fri, 13 Nov 2020 03:19:53 +0200 (CAT)

No, score=-0.566 tagged_above=-999 required=5
	tests=[ANY_BOUNCE_MESSAGE=0.1, BAYES_00=-1.9, BITCOIN_EXTORT_01=0.001,
	BOUNCE_MESSAGE=0.1, DKIM_SIGNED=0.1, DKIM_VALID=-0.1,
	DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, KAM_NUMSUBJECT=0.2,
	PDS_BTC_ID=0.329, RCVD_IN_DNSWL_MED=0.001, RCVD_IN_MSPIKE_H2=-0.001,
	SPF_HELO_PASS=-0.001, SPF_PASS=-0.001, ST_LONG_ENVELOPE_FROM=0.906,
	ST_P0F_Linux=-0.1] autolearn=no autolearn_force=no

from sengwe.utande.co.zw (localhost [127.0.0.1])
	by sengwe.utande.co.zw (Postfix) with ESMTP id 013377A4415
	for <abuse@yoafrica.com>; Fri, 13 Nov 2020 03:19:49 +0200 (CAT)

sengwe.utande.co.zw;
        dkim=pass (1024-bit rsa key sha256) header.d=netcraft.com
          header.i=@netcraft.com header.b=Bw4xmN/q header.a=rsa-sha256
          header.s=default x-bits=1024;
        spf=pass smtp.mailfrom=takedown-response+12950042@netcraft.com
          smtp.helo=mail2.netcraft.com

pass
        (netcraft.com: 52.31.138.216 is authorized to use 'takedown-response+12950042@netcraft.com' in 'mfrom' identity (mechanism 'ip4:52.31.138.216' matched))
        receiver=sengwe.utande.co.zw;
        identity=mailfrom;
        envelope-from="takedown-response+12950042@netcraft.com";
        helo=mail2.netcraft.com;
        client-ip=52.31.138.216

from mail2.netcraft.com (mail2.netcraft.com [52.31.138.216])
	by sengwe.utande.co.zw (Postfix) with ESMTPS id 0570F7A442A
	for <abuse@yoafrica.com>; Fri, 13 Nov 2020 03:19:46 +0200 (CAT)

from barbel.netcraft.com (ip-10-8-0-252.eu-west-1.compute.internal [10.8.0.252])
	(using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))
	(No client certificate requested)
	by mail2.netcraft.com (Postfix) with ESMTPS id 1534D3CAE3E
	for <abuse@yoafrica.com>; Fri, 13 Nov 2020 01:39:47 +0000 (GMT)

v=1; a=rsa-sha256; c=relaxed/relaxed; d=netcraft.com;
	s=default; t=1605231587;
	bh=FcLZ8ghw5S0BLrD6qbeNdcVEht9knwnjxOk11dpG420=;
	h=Date:From:Subject:To:From;
	b=Bw4xmN/qAZLb1bHMqRh7Ld7BRuM9yrkSLP9wfS5w9QbSToO7bK6tl9PnEz3kfCZIS
	 cMh6F48hv975siaOX3sIaHFf6crCTM6t6bsV3q2bugF0YnV7intf1i95eqQ2zkt64U
	 EHSK0D/cIWqR//ULiT7EjBS84ESaWhWcf1nPb8L0=

by barbel.netcraft.com (Postfix, from userid 507)
	id 12FC931ED41; Fri, 13 Nov 2020 01:39:47 +0000 (GMT)

Netcraft Takedown Service <takedown-response+12950042@netcraft.com>

Hello,

We have discovered an email server on your network that is sending e-mail messages that are attempting to extort users.

The server has the IP address 196.44.176.55.

We have attached an example fraudulent e-mail demonstrating the e-mail server's involvement.  Please close down this attack as soon as possible.

More information about the detected issue is provided at https://incident.netcraft.com/b09fcba3df90/

Many thanks,

Netcraft

Phone: +44(0)1225 447500
Fax: +44(0)1225 448600
Netcraft Issue Number: 12950042

To contact us about updates regarding this attack, please respond to this email. Please note: replies to this address will be logged, but aren't always read. If you believe you have received this email in error, or you require further support, please contact: takedown@netcraft.com.

This message follows the Abuse Reporting Format (ARF) so can be processed automatically. See http://www.mipassoc.org/arf/ for more information.

from changane.utande.co.zw (dagga.yoafrica.com [196.44.176.55])
	by ip-10-130-0-16 (Haraka/2.8.20) with ESMTP id 035C202A-9713-4036-B902-ABF94B789334.1
	envelope-from <salesbyo@lecsuppliers.co.zw>;
	Fri, 13 Nov 2020 00:39:20 +0000

	by changane.utande.co.zw (Postfix) with ESMTP id 54CF380C8B9EF
	for <redacted@netcraft.com>; Fri, 13 Nov 2020 02:36:07 +0200 (CAT)

from changane.utande.co.zw ([127.0.0.1])
	by localhost (changane.utande.co.zw [127.0.0.1]) (amavisd-new, port 10026)
	with ESMTP id MTHFGueFOj2E for <redacted@netcraft.com>;
	Fri, 13 Nov 2020 02:36:06 +0200 (CAT)

from [127.0.0.1] (unknown [178.254.171.102])
	(Authenticated sender: salesbyo@lecsuppliers.co.zw)
	by changane.utande.co.zw (Postfix) with ESMTPSA id D511B80D4D884
	for <redacted@netcraft.com>; Fri, 13 Nov 2020 02:36:01 +0200 (CAT)

Hi!

I am a hacker who managed to get full control over your device. 
I must tell you that I have full control over all your personal logins, photo galleries and videos. 
What's more, I have finished recording your entire watch list and I can see how much you love porn. 

I was able to record your masturbation. 
I also recorded the porn that you were watching.

Keep in mind that I can send this entry to all your contacts in the phone book, social networks and so on.

If you are wondering what bad things can be done, think of all your friends, relatives and colleagues, and what their reaction will be when they see you masturbate in that short clip that I edited. 

If you want to prevent it, send me $1000 for a BTC wallet: 191tnuK7YXeiGdsu8YFczfAseUDj4ZJGAe  
(If you don't know how to do it, then write to Google: "Buy Bitcoin").

After receiving the payment, I will delete all the materials about you.

You have 48 hours.

The malicious program I used to log in to your device is so powerful that your antivirus couldn't stop it, and there's no sign of it left in your system. 

So it is useless to go to the police or send this letter to someone. No action can be done and everything will only get complicated if you do it. 
This message has a countdown, so as soon as you see it, the two days will start to run out.

Have a nice day.

From takedown-response+12950042@netcraft.com Fri Nov 13 03:20:41 2020