from gairezi.yoafrica.com ([196.44.176.14])
	by gwayi.yoafrica.com with esmtp (Exim 4.90_1 (FreeBSD))
	(envelope-from <urlhaus-notify@abuse.ch>)
	id 1fbJAi-0009ft-2D
	for abuse@yoafrica.com; Fri, 06 Jul 2018 07:20:44 +0200

from localhost (localhost [127.0.0.1])
	by gairezi.yoafrica.com (Postfix) with ESMTP id 0AB7E2E7C52
	for <abuse@yoafrica.com>; Fri,  6 Jul 2018 07:20:44 +0200 (CAT)

Yes, score=7.023 tagged_above=-999 required=5
	tests=[BAYES_50=0.8, DKIM_ADSP_ALL=0.8, KAM_ASCII_DIVIDERS=0.8,
	KAM_NUMSUBJECT=0.5, RCVD_IN_DNSWL_MED=0.001, SPF_PASS=-0.001,
	ST_P0F_Linux=-0.1, URIBL_DBL_ABUSE_MALW=2.5, URIBL_SBL=1.623,
	URIBL_SBL_A=0.1] autolearn=no autolearn_force=no

from gairezi.yoafrica.com (localhost [127.0.0.1])
	by gairezi.yoafrica.com (Postfix) with ESMTP id A0CF12E7846
	for <abuse@yoafrica.com>; Fri,  6 Jul 2018 07:20:38 +0200 (CAT)

pass (abuse.ch: 212.25.19.53 is authorized to use 'urlhaus-notify@abuse.ch' in 'mfrom' identity (mechanism 'mx' matched)) receiver=gairezi.yoafrica.com; identity=mailfrom; envelope-from="urlhaus-notify@abuse.ch"; helo=mail.abuse.ch; client-ip=212.25.19.53

from mail.abuse.ch (mail.abuse.ch [212.25.19.53])
	by gairezi.yoafrica.com (Postfix) with ESMTP id 6ED372E7847
	for <abuse@yoafrica.com>; Fri,  6 Jul 2018 07:20:37 +0200 (CAT)

mail.abuse.ch; dkim=none reason="no signature";
	dkim-adsp=fail (unprotected policy); dkim-atps=neutral

[ ** SPAM ** ][URLhaus] abuse report: malware distribution site(s) on
	196.44.176.55

=================================================
= This message has been generated automatically =

Hello

You are receiving this email because your email address is recognized by Abuseix [1] as abuse-mail for the IP address 196.44.176.55.

This email has been generated automatically by URLhaus [2] to inform you about one or more malware distribution sites that are currently being hosted on 196.44.176.55:

* Host information
IP address: 196.44.176.55
Hostname:   dagga.yoafrica.com
AS number:  31856
AS name:    CABS

* Malware URL(s)
URL:   hXXp://www[.]nednedziwe.com/sites/En_us/Order/INV469510089279691867/
Proof: https://urlhaus.abuse.ch/url/28829

The said URLs are actively being used at the moment to distribute malware. I therefore kindly ask you to remove the said files at your earliest convenience to prevent that other internet users get infected with malware.

As the said website(s) have been likely compromised, you may also want to reset the customer's FTP account and make sure that any installed content management system (CMS) like WordPress, Typo3 or Joomla (including any 3rd party plugins) are up to date.

Should you have any question please do not hesitate to reply to this email.

Best regards,
abuse.ch 

[1] https://www.abusix.com/contactdb
[2] https://urlhaus.abuse.ch/