from mukosi.yoafrica.com ([196.44.176.140])
	by gwayi.yoafrica.com with esmtp (Exim 4.90_1 (FreeBSD))
	(envelope-from <takedown-response+2785473@netcraft.com>)
	id 1fUoLD-000BQT-VY
	for abuse@yoafrica.com; Mon, 18 Jun 2018 09:12:44 +0200

from localhost (localhost [127.0.0.1])
	by mukosi.yoafrica.com (Postfix) with ESMTP id 440B2D3DCF0
	for <abuse@yoafrica.com>; Mon, 18 Jun 2018 09:04:59 +0200 (CAT)

Yes, score=8.103 tagged_above=-999 required=5
	tests=[BAYES_50=0.8, DEAR_SOMETHING=1.973, DKIM_SIGNED=0.1,
	DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, JMQ_SPF_NEUTRAL_ALL=0.5,
	KAM_NUMSUBJECT=0.5, RAZOR2_CF_RANGE_51_100=1.886, RAZOR2_CHECK=0.922,
	RCVD_IN_DNSWL_MED=0.001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001,
	ST_P0F_Linux=-0.1, URIBL_SBL=1.623, URIBL_SBL_A=0.1]
	autolearn=no autolearn_force=no

mukosi.yoafrica.com (amavisd-new);
	dkim=pass (1024-bit key) header.d=netcraft.com

from mukosi.yoafrica.com (localhost [127.0.0.1])
	by mukosi.yoafrica.com (Postfix) with ESMTP id 71988D3DC88
	for <abuse@yoafrica.com>; Mon, 18 Jun 2018 09:04:55 +0200 (CAT)

pass (netcraft.com: 52.31.138.216 is authorized to use 'takedown-response+2785473@netcraft.com' in 'mfrom' identity (mechanism 'ip4:52.31.138.216' matched)) receiver=mukosi; identity=mailfrom; envelope-from="takedown-response+2785473@netcraft.com"; helo=mail2.netcraft.com; client-ip=52.31.138.216

from mail2.netcraft.com (mail2.netcraft.com [52.31.138.216])
	by mukosi.yoafrica.com (Postfix) with ESMTP id 40493D3DCEA
	for <abuse@yoafrica.com>; Mon, 18 Jun 2018 09:04:51 +0200 (CAT)

from barbel.netcraft.com (ip-10-8-0-252.eu-west-1.compute.internal [10.8.0.252])
	(using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))
	(No client certificate requested)
	by mail2.netcraft.com (Postfix) with ESMTPS id B261133C185
	for <abuse@yoafrica.com>; Mon, 18 Jun 2018 08:12:33 +0100 (BST)

v=1; a=rsa-sha256; c=relaxed/relaxed; d=netcraft.com;
	s=default; t=1529305953;
	bh=jm7Jj9R6snduDyQSPwwyAUJBCUeo2WhQYvR+593DLWw=;
	h=Date:From:Subject:To:From;
	b=npKjUVHI5COZaRhBoEFyypyWRJV8jinceaM9ovWEZ7nelzmM0CXFSZV6lDu3FUB5Q
	 ra8ujkVgN0kO1ztpvBOAkMQRZlXdEGEY0r+sL/WyFOTxBxMI6e7R6DkyxMUpYR0BLj
	 XJF9GsEgJFWCoUDwmCNbwF+uHJR78vgOLt6zN7t8=

by barbel.netcraft.com (Postfix, from userid 507)
	id A7F04306CC4; Mon, 18 Jun 2018 08:12:33 +0100 (BST)

Netcraft Takedown Service <takedown-response+2785473@netcraft.com>

[ ** SPAM ** ]Issue 2785473: phishing attack at
	http://chocolicious.co.zw/3arabiya/client-update-5fgh5f4gh65df4h6d5f4h6df5h46f5h46dfh54df6h54df6h45df65465f45fdh64dhfg546df4g6sdg546sdg0/pp/complete.php?ip=105.67.4.153

Dear Sir or Madam,

We have discovered a phishing attack located on your network:

http://chocolicious.co.zw/3arabiya/client-update-5fgh5f4gh65df4h6d5f4h6df5h46f5h46dfh54df6h54df6h45df65465f45fdh64dhfg546df4g6sdg546sdg0/pp/complete.php?ip=105.67.4.153 [196.44.176.55]

This attack targets our customer, Netflix, website URL https://www.netflix.com/.

Would it be possible to have the fraudulent content, and any other associated fraudulent content, taken down as soon as possible?

Additionally, please send any files associated with the fraudulent content to records@netflix.com so that our customer and law enforcement agencies can investigate the incident further.

Many thanks,

Netcraft

Phone: +44(0)1225 447500
Fax: +44(0)1225 448600

Netcraft Issue Number: 2785473

To contact us about updates regarding this attack, please respond to this email. Please note: replies to this address will be logged, but aren't always read. If you believe you have received this email in error, or you require further support, please contact: takedown@netcraft.com.

This mail can be parsed with x-arf tools. Visit http://www.xarf.org/ for more information about x-arf.

---
Attachment: none
Category: fraud
Date: 2018-06-18T07:11:54+00:00
Domain: chocolicious.co.zw
Port: 80
Report-ID: takedown-response+2785473@netcraft.com
Report-Type: phishing
Reported-From: takedown@netcraft.com
Schema-URL: http://www.xarf.org/schema/fraud_0.1.4.json
Service: http
Source: http://chocolicious.co.zw/3arabiya/client-update-5fgh5f4gh65df4h6d5f4h6df5h46f5h46dfh54df6h54df6h45df65465f45fdh64dhfg546df4g6sdg546sdg0/pp/complete.php?ip=105.67.4.153
Source-Type: uri
User-Agent: Netcraft Takedown


From takedown-response+2785473@netcraft.com Mon Jun 18 09:12:44 2018