from gairezi.yoafrica.com ([196.44.176.14])
	by gwayi.yoafrica.com with esmtp (Exim 4.90_1 (FreeBSD))
	(envelope-from <ir@brandprotect.com>)
	id 1fXNRK-0007C3-T3
	for dnsadmin@yoafrica.com; Mon, 25 Jun 2018 11:05:38 +0200

from localhost (localhost [127.0.0.1])
	by gairezi.yoafrica.com (Postfix) with ESMTP id D35092E7D40
	for <dnsadmin@yoafrica.com>; Mon, 25 Jun 2018 11:05:38 +0200 (CAT)

No, score=1.399 tagged_above=-999 required=5
	tests=[BAYES_40=-0.001, HTML_MESSAGE=0.001,
	RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, ST_P0F_W=1.4]
	autolearn=no autolearn_force=no

from gairezi.yoafrica.com (localhost [127.0.0.1])
	by gairezi.yoafrica.com (Postfix) with ESMTP id 364DE2E7C74
	for <dnsadmin@yoafrica.com>; Mon, 25 Jun 2018 11:05:34 +0200 (CAT)

delayed 1034 seconds at gairezi.yoafrica.com, Mon, 25 Jun 2018 11:05:32 CAT

pass (brandprotect.com: 216.151.35.86 is authorized to use 'ir@brandprotect.com' in 'mfrom' identity (mechanism 'ip4:216.151.35.0/24' matched)) receiver=gairezi.yoafrica.com; identity=mailfrom; envelope-from="ir@brandprotect.com"; helo=bdsvr10.brandimensions.net; client-ip=216.151.35.86

from bdsvr10.brandimensions.net (bdsvr10.brandimensions.net [216.151.35.86])
	by gairezi.yoafrica.com (Postfix) with ESMTP id 9DBDF2E7C77
	for <dnsadmin@yoafrica.com>; Mon, 25 Jun 2018 11:05:32 +0200 (CAT)

from bpjob29 ([10.1.128.186]) by bdsvr10.brandimensions.net with Microsoft SMTPSVC(8.5.9600.16384);
	 Mon, 25 Jun 2018 04:48:11 -0400

multipart/alternative;
	boundary="----=_NextPart_000_14A47_01D40C3F.B8310400"

We have detected a phishing page on your network at 196.44.176.55,
first detected at 09:27, June 24 ET (UTC -4).

Our client, Tangerine Bank, requests that the page be disabled
immediately.

URL on 196.44.176.55 
hxxp://chocolicious[.]co[.]zw/language/pdf_fonts/VAR/ING_cc/82655

Please reply to this message to confirm receipt and update us on the
status of shutting down the fraudulent site.

Please also provide any files associated with this attack (such as
phishing kits, zip files, etc), so that we can perform analysis. 

Thank you in advance,
Daryl Fulop | Incident Response Analyst | +1-866-757-5678
[27912366]


<html><head><META http-equiv="Content-Type" content="text/html; charset=utf-16"></head><body link="blue" vlink="purple">We have detected a phishing page on your network at 196.44.176.55, first detected at  09:27, June 24 ET (UTC -4).<br><br>Our client, Tangerine Bank, requests that the page be disabled immediately.<br><br>URL on 196.44.176.55 <br>hxxp://chocolicious[.]co[.]zw/language/pdf_fonts/VAR/ING_cc/82655<br><br>Please reply to this message to confirm receipt and update us on the status of shutting down the fraudulent site.<br><br>Please also provide any files associated with this attack (such as phishing kits, zip files, etc), so that we can perform analysis.  <br><br>Thank you in advance,<br>Daryl Fulop | Incident Response Analyst | +1-866-757-5678<br>[27912366]</body></html>