from mukosi.yoafrica.com ([196.44.176.140])
	by gwayi.yoafrica.com with esmtp (Exim 4.90_1 (FreeBSD))
	(envelope-from <soc@phishlabs.com>)
	id 1fWhMR-0003VT-D6
	for abuse@yoafrica.com; Sat, 23 Jun 2018 14:09:47 +0200

from localhost (localhost [127.0.0.1])
	by mukosi.yoafrica.com (Postfix) with ESMTP id 5270ED3DC5E
	for <abuse@yoafrica.com>; Sat, 23 Jun 2018 14:01:58 +0200 (CAT)

No, score=3.202 tagged_above=-999 required=5
	tests=[BAYES_50=0.8, SPF_NEUTRAL=0.779, ST_P0F_Linux=-0.1,
	URIBL_SBL=1.623, URIBL_SBL_A=0.1] autolearn=no autolearn_force=no

from mukosi.yoafrica.com (localhost [127.0.0.1])
	by mukosi.yoafrica.com (Postfix) with ESMTP id 78CF4D3DC37
	for <abuse@yoafrica.com>; Sat, 23 Jun 2018 14:01:55 +0200 (CAT)

neutral (phishlabs.com: Default neutral result due to no mechanism matches) receiver=mukosi; identity=mailfrom; envelope-from="soc@phishlabs.com"; helo=mtsapi1.phishlabs.com; client-ip=52.71.51.126

from mtsapi1.phishlabs.com (mtsapi1.phishlabs.com [52.71.51.126])
	by mukosi.yoafrica.com (Postfix) with ESMTP id 321A5D3DBF7
	for <abuse@yoafrica.com>; Sat, 23 Jun 2018 14:01:53 +0200 (CAT)

	by mtsapi1.phishlabs.com (8.14.4/8.14.4) with ESMTP id w5NC9cFx028911;
	Sat, 23 Jun 2018 12:09:38 GMT

During an investigation of fraud, we discovered a compromised website (choc=
olicious.co.zw) that is being used to attack our client and their customers=
.

In addition to the website owner, we have addressed this report to the resp=
onsible authoritative providers who have the ability to disable the malicio=
us content in question. Based on your relationship to the content in questi=
on, please see our specific request below.

This threat has been active for at least 0.4 hours.

hXXp://chocolicious.co.zw/language/pdf_fonts/VAR/ING_cc/fec65
hXXp://chocolicious.co.zw/language/pdf_fonts/VAR/ING_cc/fec65/
hXXp://chocolicious.co.zw/language/pdf_fonts/VAR/ING_cc/
hXXp://chocolicious.co.zw/language/pdf_fonts/VAR/ING_cc/fec65/index2.html
hXXp://chocolicious.co.zw/language/pdf_fonts/VAR/ING_cc/fec65/index3.html
hXXp://chocolicious.co.zw/language/pdf_fonts/VAR/ING_cc/index.php

First detection of malicious activity: 06-23-2018 11:46:51 UTC
Most recent observation of malicious activity: 06-23-2018 12:09:28 UTC
Associated IP Addresses:
196.44.176.55

=3D=3D=3D   HOSTING  PROVIDER   =3D=3D=3D
If you agree that this is malicious, we kindly request that you take steps =
to have the content removed as soon as possible.  It is highly likely that =
the intruder who set up this phishing content has also left additional frau=
dulent material on this server such as illegitimate access points.

=3D=3D=3D     WEBSITE OWNER     =3D=3D=3D
We recommend taking the following actions to secure the web site and preven=
t the attackers from returning:
    - Update your web applications including CMS, blog, ecommerce, and othe=
r applications (and all add-on modules/components/plugins).
    - Search all of your web directories for suspicious files as attackers =
commonly leave backdoors.
    - Scan the computer from which you login to your web hosting control pa=
nel or ftp server with anti-virus software.=20
    - Change your web hosting provider if this is an ongoing issue.

If your provider has disabled your account because of this incident, you mu=
st coordinate a resolution with them directly as PhishLabs has no control o=
ver this aspect.

If we have contacted you in error, or if there is a better way for us to re=
port this incident, please let us know so that we may continue our investig=
ation.

We are grateful for your assistance. =20

Kind regards, =20
Lindsay Richardson
PhishLabs Security Operations
12023866001
Available 24/7

[PL-808942]=20