from gairezi.yoafrica.com ([196.44.176.14])
	by gwayi.yoafrica.com with esmtp (Exim 4.90_1 (FreeBSD))
	(envelope-from <takedown-response+2785473@netcraft.com>)
	id 1fU6VZ-0006UQ-0V
	for abuse@yoafrica.com; Sat, 16 Jun 2018 10:24:29 +0200

from localhost (localhost [127.0.0.1])
	by gairezi.yoafrica.com (Postfix) with ESMTP id EE6792E7E2B
	for <abuse@yoafrica.com>; Sat, 16 Jun 2018 10:24:28 +0200 (CAT)

Yes, score=8.103 tagged_above=-999 required=5
	tests=[BAYES_50=0.8, DEAR_SOMETHING=1.973, DKIM_SIGNED=0.1,
	DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, JMQ_SPF_NEUTRAL_ALL=0.5,
	KAM_NUMSUBJECT=0.5, RAZOR2_CF_RANGE_51_100=1.886, RAZOR2_CHECK=0.922,
	RCVD_IN_DNSWL_MED=0.001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001,
	ST_P0F_Linux=-0.1, URIBL_SBL=1.623, URIBL_SBL_A=0.1]
	autolearn=no autolearn_force=no

gairezi.yoafrica.com (amavisd-new);
	dkim=pass (1024-bit key) header.d=netcraft.com

from gairezi.yoafrica.com (localhost [127.0.0.1])
	by gairezi.yoafrica.com (Postfix) with ESMTP id 680C42E7D19
	for <abuse@yoafrica.com>; Sat, 16 Jun 2018 10:24:23 +0200 (CAT)

pass (netcraft.com: 52.31.138.216 is authorized to use 'takedown-response+2785473@netcraft.com' in 'mfrom' identity (mechanism 'ip4:52.31.138.216' matched)) receiver=gairezi.yoafrica.com; identity=mailfrom; envelope-from="takedown-response+2785473@netcraft.com"; helo=mail2.netcraft.com; client-ip=52.31.138.216

from mail2.netcraft.com (mail2.netcraft.com [52.31.138.216])
	by gairezi.yoafrica.com (Postfix) with ESMTP id 358492E7C96
	for <abuse@yoafrica.com>; Sat, 16 Jun 2018 10:24:21 +0200 (CAT)

from barbel.netcraft.com (ip-10-8-0-252.eu-west-1.compute.internal [10.8.0.252])
	(using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))
	(No client certificate requested)
	by mail2.netcraft.com (Postfix) with ESMTPS id 26EB7334682
	for <abuse@yoafrica.com>; Sat, 16 Jun 2018 09:24:20 +0100 (BST)

v=1; a=rsa-sha256; c=relaxed/relaxed; d=netcraft.com;
	s=default; t=1529137460;
	bh=ZIesykqInkP9d+QnoZM7+P/39zz9gSeNjnkc0D9iGV0=;
	h=Date:From:Subject:To:From;
	b=zyjgykENeNmcRPwbOUhVJ7R7CZXJCEJK3nCLirIySTfC7QtegFaBwVwZIuFH/TIqJ
	 vF/qFJ7dV59BfjVEna9zG0sqzkQO/Pfc494+Z6u2bLitGgRyKZHNAXrC5XtkgemL3Z
	 8gOXBEl0rFtYyqAZnHD7WcRB2IuqML/LjVUuQ45g=

by barbel.netcraft.com (Postfix, from userid 507)
	id 1C299306CC4; Sat, 16 Jun 2018 09:24:20 +0100 (BST)

Netcraft Takedown Service <takedown-response+2785473@netcraft.com>

[ ** SPAM ** ]Issue 2785473: phishing attack at
	http://chocolicious.co.zw/3arabiya/client-update-5fgh5f4gh65df4h6d5f4h6df5h46f5h46dfh54df6h54df6h45df65465f45fdh64dhfg546df4g6sdg546sdg0/pp/complete.php?ip=105.67.4.153

Dear Sir or Madam,

We have discovered a phishing attack located on your network:

http://chocolicious.co.zw/3arabiya/client-update-5fgh5f4gh65df4h6d5f4h6df5h46f5h46dfh54df6h54df6h45df65465f45fdh64dhfg546df4g6sdg546sdg0/pp/complete.php?ip=105.67.4.153 [196.44.176.55]

This attack targets our customer, Netflix, website URL https://www.netflix.com/.

Would it be possible to have the fraudulent content, and any other associated fraudulent content, taken down as soon as possible?

Additionally, please send any files associated with the fraudulent content to records@netflix.com so that our customer and law enforcement agencies can investigate the incident further.

Many thanks,

Netcraft

Phone: +44(0)1225 447500
Fax: +44(0)1225 448600

Netcraft Issue Number: 2785473

To contact us about updates regarding this attack, please respond to this email. Please note: replies to this address will be logged, but aren't always read. If you believe you have received this email in error, or you require further support, please contact: takedown@netcraft.com.

This mail can be parsed with x-arf tools. Visit http://www.xarf.org/ for more information about x-arf.

---
Attachment: none
Category: fraud
Date: 2018-06-16T08:23:59+00:00
Domain: chocolicious.co.zw
Port: 80
Report-ID: takedown-response+2785473@netcraft.com
Report-Type: phishing
Reported-From: takedown@netcraft.com
Schema-URL: http://www.xarf.org/schema/fraud_0.1.4.json
Service: http
Source: http://chocolicious.co.zw/3arabiya/client-update-5fgh5f4gh65df4h6d5f4h6df5h46f5h46dfh54df6h54df6h45df65465f45fdh64dhfg546df4g6sdg546sdg0/pp/complete.php?ip=105.67.4.153
Source-Type: uri
User-Agent: Netcraft Takedown


From takedown-response+2785473@netcraft.com Sat Jun 16 10:24:29 2018