from gairezi.yoafrica.com ([196.44.176.14])
	by gwayi.yoafrica.com with esmtp (Exim 4.90_1 (FreeBSD))
	(envelope-from <ir@brandprotect.com>)
	id 1fXR0g-000CaP-Gz
	for dnsadmin@yoafrica.com; Mon, 25 Jun 2018 14:54:22 +0200

from localhost (localhost [127.0.0.1])
	by gairezi.yoafrica.com (Postfix) with ESMTP id 7CEAA2E8223
	for <dnsadmin@yoafrica.com>; Mon, 25 Jun 2018 14:54:22 +0200 (CAT)

No, score=-0.5 tagged_above=-999 required=5
	tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001,
	SPF_PASS=-0.001, ST_P0F_W=1.4] autolearn=no autolearn_force=no

from gairezi.yoafrica.com (localhost [127.0.0.1])
	by gairezi.yoafrica.com (Postfix) with ESMTP id A0F8D2E8200
	for <dnsadmin@yoafrica.com>; Mon, 25 Jun 2018 14:54:17 +0200 (CAT)

pass (brandprotect.com: 216.151.35.86 is authorized to use 'ir@brandprotect.com' in 'mfrom' identity (mechanism 'ip4:216.151.35.0/24' matched)) receiver=gairezi.yoafrica.com; identity=mailfrom; envelope-from="ir@brandprotect.com"; helo=bdsvr10.brandimensions.net; client-ip=216.151.35.86

from bdsvr10.brandimensions.net (bdsvr10.brandimensions.net [216.151.35.86])
	by gairezi.yoafrica.com (Postfix) with ESMTP id 194CD2E8190
	for <dnsadmin@yoafrica.com>; Mon, 25 Jun 2018 14:54:15 +0200 (CAT)

from bpjob29 ([10.1.128.186]) by bdsvr10.brandimensions.net with Microsoft SMTPSVC(8.5.9600.16384);
	 Mon, 25 Jun 2018 08:54:11 -0400

multipart/alternative;
	boundary="----=_NextPart_000_14B87_01D40C62.15F5B6E0"

We have detected a phishing page on your network at 196.44.176.55,
first detected at 03:55, June 25 ET (UTC -4).

Our client, Tangerine Bank, requests that the page be disabled
immediately.

URL on 196.44.176.55 
hxxp://chocolicious[.]co[.]zw/images/Gallery/_STOTRE/ING_cc/5c71d

Please reply to this message to confirm receipt and update us on the
status of shutting down the fraudulent site.

Please also provide any files associated with this attack (such as
phishing kits, zip files, etc), so that we can perform analysis. 

Thank you in advance,
Daryl Fulop | Incident Response Analyst | +1-866-757-5678
[27923494]


<html><head><META http-equiv="Content-Type" content="text/html; charset=utf-16"></head><body link="blue" vlink="purple">We have detected a phishing page on your network at 196.44.176.55, first detected at  03:55, June 25 ET (UTC -4).<br><br>Our client, Tangerine Bank, requests that the page be disabled immediately.<br><br>URL on 196.44.176.55 <br>hxxp://chocolicious[.]co[.]zw/images/Gallery/_STOTRE/ING_cc/5c71d<br><br>Please reply to this message to confirm receipt and update us on the status of shutting down the fraudulent site.<br><br>Please also provide any files associated with this attack (such as phishing kits, zip files, etc), so that we can perform analysis.  <br><br>Thank you in advance,<br>Daryl Fulop | Incident Response Analyst | +1-866-757-5678<br>[27923494]</body></html>