from gairezi.yoafrica.com ([196.44.176.14])
	by gwayi.yoafrica.com with esmtp (Exim 4.90_1 (FreeBSD))
	(envelope-from <soc@phishlabs.com>)
	id 1fWkS2-000AYE-FK; Sat, 23 Jun 2018 17:27:46 +0200

from localhost (localhost [127.0.0.1])
	by gairezi.yoafrica.com (Postfix) with ESMTP id 6ECFD2E790B;
	Sat, 23 Jun 2018 17:27:46 +0200 (CAT)

No, score=3.302 tagged_above=-999 required=5
	tests=[BAYES_50=0.8, SPF_NEUTRAL=0.779, URIBL_SBL=1.623,
	URIBL_SBL_A=0.1] autolearn=no autolearn_force=no

from gairezi.yoafrica.com (localhost [127.0.0.1])
	by gairezi.yoafrica.com (Postfix) with ESMTP id 7BA072E784F;
	Sat, 23 Jun 2018 17:27:41 +0200 (CAT)

neutral (phishlabs.com: Default neutral result due to no mechanism matches) receiver=gairezi.yoafrica.com; identity=mailfrom; envelope-from="soc@phishlabs.com"; helo=mtsapi2.phishlabs.com; client-ip=34.200.132.149

delayed 12322 seconds at gairezi.yoafrica.com, Sat, 23 Jun 2018 17:27:41 CAT

from mtsapi2.phishlabs.com (mtsapi2.phishlabs.com [34.200.132.149])
	by gairezi.yoafrica.com (Postfix) with ESMTP id 333FA2E77F5;
	Sat, 23 Jun 2018 17:27:39 +0200 (CAT)

	by mtsapi2.phishlabs.com (8.14.4/8.14.4) with ESMTP id w5NFRZbu003501;
	Sat, 23 Jun 2018 15:27:35 GMT

During an investigation of fraud, we discovered a compromised website (choc=
olicious.co.zw) that is being used to attack our client and their customers=
.

In addition to the website owner, we have addressed this report to the resp=
onsible authoritative providers who have the ability to disable the malicio=
us content in question. Based on your relationship to the content in questi=
on, please see our specific request below.

This threat has been active for at least 3.4 hours.

hXXp://chocolicious.co.zw/logs/Clients/ING_cc/
hXXp://chocolicious.co.zw/logs/Clients/ING_cc/afbf8/index2.html
hXXp://chocolicious.co.zw/language/pdf_fonts/VAR/ING_cc/fec65/index2.html
hXXp://chocolicious.co.zw/language/pdf_fonts/VAR/ING_cc/index.php
hXXp://chocolicious.co.zw/logs/Clients/ING_cc/afbf8/index3.html
hXXp://chocolicious.co.zw/logs/Clients/ING_cc/f404a
hXXp://chocolicious.co.zw/language/pdf_fonts/VAR/ING_cc/
hXXp://chocolicious.co.zw/language/pdf_fonts/VAR/ING_cc/fec65/index3.html
hXXp://chocolicious.co.zw/language/pdf_fonts/VAR/ING_cc/fec65/

First detection of malicious activity: 06-23-2018 11:46:51 UTC
Most recent observation of malicious activity: 06-23-2018 15:27:29 UTC
Associated IP Addresses:
196.44.176.55

=3D=3D=3D   HOSTING  PROVIDER   =3D=3D=3D
If you agree that this is malicious, we kindly request that you take steps =
to have the content removed as soon as possible.  It is highly likely that =
the intruder who set up this phishing content has also left additional frau=
dulent material on this server such as illegitimate access points.

=3D=3D=3D     WEBSITE OWNER     =3D=3D=3D
We recommend taking the following actions to secure the web site and preven=
t the attackers from returning:
    - Update your web applications including CMS, blog, ecommerce, and othe=
r applications (and all add-on modules/components/plugins).
    - Search all of your web directories for suspicious files as attackers =
commonly leave backdoors.
    - Scan the computer from which you login to your web hosting control pa=
nel or ftp server with anti-virus software.=20
    - Change your web hosting provider if this is an ongoing issue.

If your provider has disabled your account because of this incident, you mu=
st coordinate a resolution with them directly as PhishLabs has no control o=
ver this aspect.

If we have contacted you in error, or if there is a better way for us to re=
port this incident, please let us know so that we may continue our investig=
ation.

We are grateful for your assistance. =20

Kind regards, =20
Lindsay Richardson
PhishLabs Security Operations
12023866001
Available 24/7

[PL-809126]=20