Dear Host Africa. Could you stop hosting malicious web sites?

[No this is Patrick]

Malicious JavaScript attachment disguised as a JPEG image:

IMG-20260723-WA0007.JPG.js

The script is heavily obfuscated and contains thousands of repeated lines intended to conceal its true functionality.

Analysis indicates that the script:

• Creates a Windows Script Host object (ActiveXObject("WScript.Shell")).
• Reconstructs an obfuscated PowerShell payload.
• Uses .NET functionality (System.Text.Encoding, System.Convert, Net.WebClient) to decode and execute additional commands.
• Downloads a second-stage payload from the following URL:

https://deliverymailreport.co.za/MSI_214135.png

Although the file has a .png extension, the script downloads it as raw binary data using PowerShell's DownloadData() method, indicating that it is intended to be executed or further processed rather than displayed as an image.

Based on the behaviour observed, this appears to be a malware downloader distributed via phishing emails.

I did not execute the script. It was examined only as plain text after being renamed to .txt

I respectfully request that your Abuse/Security team @_Ryan_ investigate:

• The URL listed above.
• The associated hosting account.
• Any additional malicious content associated with the same customer or infrastructure.
• Delete any selfie videos that the attacker may have of me pleasuring myself.

This is one of many malicious files that I receive from various sites hosted with Host Africa. Please do something.

Kind Regards,
Patrick

 

[Murmaider]

Any reason you came to myBB to post about it, instead of opening an abuse ticket with them directly?

 

[WAslayer]

Any reason you came to myBB to post about it, instead of opening an abuse ticket with them directly?

Feeling like he needs to brag about what he found...

 

[Jade @ Absolute Hosting]

Hi Patrick, can you edit the url to the site and replace .co.za with [.]co[.]za as to avoid unsuspecting people who visit this thread from clicking on that link.

https://www.joesandbox.com/analysis/1943338/1/html

 

[Anthro]

I can give you their CEO's Telephone number if you want it