WEBMAIL phish running on rittinghousesewandvac[.]com

Found: 2018-03-27 02:26:23.889000
URL: http://rittinghousesewandvac.com/wp-includes/pomo/Mailbox.zip
File: rittinghousesewandvac.com-pomo-Mailbox.zip
Domain: rittinghousesewandvac.com
Target: WEBMAIL
Name                                               Size Date                 MD5                                Mailbox/Mailbox/index.php                            272 2017-09-04 00:01:20  991f96989f73ef3baf468f6c1c0fea17
    File appears in 5 kits
Mailbox/Mailbox/login.php                            609 2017-09-04 00:04:06  e0754e79b2ab4371ff9b1287201a53ea
Mailbox/Mailbox/thankyou.html                       7581 2017-09-04 00:01:20  8c500c2ae0dfd1a4006d767aba160522
Mailbox/Mailbox/WebMail Sign In_files/app.css       2210 2017-09-04 00:01:20  381c0a51f0563e4a87e89c51abec0c42
    File appears in 5 kits
Mailbox/Mailbox/WebMail Sign In_files/app.js       94063 2017-09-04 00:01:20  e9bdf69c5599695b5fac5922548ae4b8
    File appears in 5 kits
Mailbox/Mailbox/WebMail Sign In_files/mail.png      4099 2017-09-04 00:01:20  6aeed6c92c8216cdb77a4e0113b9ddd0
    File appears in 5 kits
Mailbox/Mailbox/webmail.php                         2947 2017-09-04 00:01:20  fe26c5d0ef90ea5b63aa01c796303c8f

4 Email addresses found:
    lavameriedaujourdhui@gmail.com
    'name@example.com (appears in 3 kits)
    elem.value=='name@example.com (appears in 3 kits)
    elem.value='name@example.com (appears in 3 kits)



https://texasmalwareblog.blogspot.com   @phish_total