from mushawe.yoafrica.com ([196.44.176.11] helo=mushawe.utande.co.zw)
	by gwayi.yoafrica.com with esmtp (Exim 4.90_1 (FreeBSD))
	(envelope-from <takedown-response+14934036@netcraft.com>)
	id 1l5pmJ-000GfL-Hx
	for abuse@yoafrica.com; Sat, 30 Jan 2021 14:55:03 +0200

from [41.190.32.2] (port=26857 helo=sengwe.utande.co.zw)
	by mushawe.utande.co.zw with esmtp (Exim 4.94)
	id 1l5pxi-0001CD-DJ
	for abuse@yoafrica.com; Sat, 30 Jan 2021 15:06:50 +0200

from localhost (localhost [127.0.0.1])
	by sengwe.utande.co.zw (Postfix) with ESMTP id A970D7A4510
	for <abuse@yoafrica.com>; Sat, 30 Jan 2021 14:44:54 +0200 (CAT)

No, score=4.261 tagged_above=-999 required=5
	tests=[ANY_BOUNCE_MESSAGE=0.1, BAYES_00=-1.9, BITCOIN_EXTORT_01=4.157,
	BOUNCE_MESSAGE=0.1, DKIM_SIGNED=0.1, DKIM_VALID=-0.1,
	DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, JMQ_SPF_NEUTRAL=0.5,
	KAM_NUMSUBJECT=0.2, PDS_BTC_ID=0.499, RCVD_IN_DNSWL_MED=0.001,
	SPF_HELO_PASS=-0.001, SPF_PASS=-0.001, ST_LONG_ENVELOPE_FROM=0.906,
	ST_P0F_Linux=-0.1] autolearn=no autolearn_force=no

from sengwe.utande.co.zw (localhost [IPv6:::1])
	by sengwe.utande.co.zw (Postfix) with ESMTP id 24BE77A4441
	for <abuse@yoafrica.com>; Sat, 30 Jan 2021 14:44:50 +0200 (CAT)

sengwe.utande.co.zw;
        dkim=pass (1024-bit rsa key sha256) header.d=netcraft.com
          header.i=@netcraft.com header.b=bD4PxVMp header.a=rsa-sha256
          header.s=default x-bits=1024;
        spf=pass smtp.mailfrom=takedown-response+14934036@netcraft.com
          smtp.helo=mail2.netcraft.com

pass
        (netcraft.com: 52.31.138.216 is authorized to use 'takedown-response+14934036@netcraft.com' in 'mfrom' identity (mechanism 'ip4:52.31.138.216' matched))
        receiver=sengwe.utande.co.zw;
        identity=mailfrom;
        envelope-from="takedown-response+14934036@netcraft.com";
        helo=mail2.netcraft.com;
        client-ip=52.31.138.216

from mail2.netcraft.com (mail2.netcraft.com [52.31.138.216])
	by sengwe.utande.co.zw (Postfix) with ESMTPS id E407A7A441D
	for <abuse@yoafrica.com>; Sat, 30 Jan 2021 14:44:47 +0200 (CAT)

from barbel.netcraft.com (ip-10-8-0-252.eu-west-1.compute.internal [10.8.0.252])
	(using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))
	(No client certificate requested)
	by mail2.netcraft.com (Postfix) with ESMTPS id E340437ADC8
	for <abuse@yoafrica.com>; Sat, 30 Jan 2021 13:08:35 +0000 (GMT)

v=1; a=rsa-sha256; c=relaxed/relaxed; d=netcraft.com;
	s=default; t=1612012115;
	bh=5pJDc/5rjZ35Y8I9E3BBmUswgxyuSMI5NlaVeR3ZWcM=;
	h=Date:From:Subject:To:From;
	b=bD4PxVMpls84Cbg+TfJN5/QKvfxyeGuBV8HndLdAEHVXC3tzdIUHHatw33zQS/3W0
	 pQ2nl8FO9I0SGdFsVHRwu6sAWkFqHeehH4R/i2/aetLsXae8OPtNtgiPw7ruObpxjk
	 O3zazRom4dGylCd+3mGXl5ntwQs4r8hZKEqXgEYo=

by barbel.netcraft.com (Postfix, from userid 507)
	id E0EB531F57A; Sat, 30 Jan 2021 13:08:35 +0000 (GMT)

Netcraft Takedown Service <takedown-response+14934036@netcraft.com>

Hello,

We have discovered an email server on your network that is sending e-mail messages that are attempting to extort users.

The server has the IP address 196.44.176.55.

We have attached an example fraudulent e-mail demonstrating the e-mail server's involvement.  Please close down this attack as soon as possible.

More information about the detected issue is provided at https://incident.netcraft.com/57e974484050/

Many thanks,

Netcraft

Phone: +44(0)1225 447500
Fax: +44(0)1225 448600
Netcraft Issue Number: 14934036

To contact us about updates regarding this attack, please respond to this email. Please note: replies to this address will be logged, but aren't always read. If you believe you have received this email in error, or you require further support, please contact: takedown@netcraft.com.

This message follows the Abuse Reporting Format (ARF) so can be processed automatically. See http://www.mipassoc.org/arf/ for more information.

from park-mx.above.com (park-mx.above.com [103.224.212.34])
	by ip-10-130-0-36 (Haraka/2.8.20) with ESMTP id D440B149-B5C2-4728-B391-4ACBA40E8223.45
	envelope-from <cornelius@halahotels.co.zw>;
	Sat, 30 Jan 2021 13:05:20 +0000

from changane.utande.co.zw ([196.44.176.55])
	by park-mx.above.com (Conveyor) with ESMTP id 2a2d9177730e2c63
	for <redacted@netcraft.com>; Sun, 31 Jan 2021 00:05:20 +1100

	by changane.utande.co.zw (Postfix) with ESMTP id A029B8126488D
	for <redacted@netcraft.com>; Sat, 30 Jan 2021 15:05:17 +0200 (CAT)

from changane.utande.co.zw ([127.0.0.1])
	by localhost (changane.utande.co.zw [127.0.0.1]) (amavisd-new, port 10026)
	with ESMTP id WGbg0A3rm-NA for <redacted@netcraft.com>;
	Sat, 30 Jan 2021 15:05:16 +0200 (CAT)

from [127.0.0.1] (unknown [39.121.2.76])
	(Authenticated sender: cornelius@halahotels.co.zw)
	by changane.utande.co.zw (Postfix) with ESMTPSA id 46DB98125EA17
	for <redacted@netcraft.com>; Sat, 30 Jan 2021 15:05:13 +0200 (CAT)

Greetings.
I monitored your device on the net for a long time and successfully managed to hack it. It was not difficult for me, as I have been in this business for a long time.

When you visited a pornography site, I was able to put a virus on your computer that gave me full access to your device, namely your camera, microphone, phone calls, messengers, what happens on your screen, phone book, passwords to all social networks, etc.

To hide my virus, I have written a special driver which is updated every 4 hours and makes it impossible to detect it.

I captured video of your screen and camera device and edited a video of you masturbating in one part of the screen and a pornographic video that you opened at that moment in the other part of the screen.

I can safely send any data from your device to the Internet, as well as anyone who is recorded in your contacts, messengers and social networks.
I can also give anyone access to your social networks, emails and messengers.

If you don't want me to do it, then:
Transfer $1300 (US dollars) to my Bitcoin wallet.

My Bitcoin wallet address: bc1qpae26vlj5dnlxgwt2xjyw69sz3e596xs9xtwkn

I give you 48 hours to transfer the money. Otherwise, I will perform the above. 
The timer started automatically as soon as you opened the email. 
I am also automatically notified when this email is opened.

If you do not know how to transfer money and what Bitcoin is. Then type "Buy Bitcoin" into Google

As soon as I receive a transfer of the required amount, the system will automatically inform me about the received payment and offer to delete from my servers all the data I received from you. 
And therefore, I will confirm the deletion.

Do not try to complain anywhere, as a purse does not track, mail from where the letter came, and is not tracked and created automatically, so there is no point in writing to me.
If you try to share this email with anyone, the system will automatically send a request to the servers and they will proceed to upload all the data to social networks. Also, changing passwords in social networks, mail, device will not help you, because all the data is already downloaded to a cluster of my servers.

Good luck.

From takedown-response+14934036@netcraft.com Sat Jan 30 14:55:03 2021