2018-11-12 #phishingkit actor emails 185.52.3.156

#phishingkit actor emails
https://twitter.com/Techhelplistcom/status/1061885792027586560
185.52.3.156 http://routelabel.net  hosting



12\12\12\authenticate.php:$email= "cforeplyto@gmail.com";
12\12\12\login.php:$email= "cforeplyto@gmail.com";
drop\newdropbox\00\000\001\index\gm33ail\geemail.php:	$to ="andyjames009@yandex.com";
2019box\SA\drop\newdropbox\00\000\001\index\li33ve\li33ve.php:	$to ="gdaan7@gmail.com";
2019box\SA\drop\newdropbox\00\000\001\index\off33ice\off33ice.php:	$to ="gdaan7@gmail.com";
2019box\SA\drop\newdropbox\00\000\001\index\others\otherother.php:	$to ="gdaan7@gmail.com";
2019box\SA\drop\newdropbox\00\000\001\index\yah33oo\yah33oo.php:	$to ="gdaan7@gmail.com";
Anymail%20Magnet\magnet\loader.php:$to = "mchlliving@gmail.com";
Anymail%20Magnet\magnet\Verify.php:$to = "mchlliving@gmail.com";
Anymail%20Magnet%20-%20zilo\magnet\loader.php:$to = "zakichahul@gmail.com";
Anymail%20Magnet%20-%20zilo\magnet\Verify.php:$to = "zakichahul@gmail.com";
luno\index2.php:    $to = "markjamesons717@gmail.com";
luno\index2.php:        "CC:markjamesons717@gmail.com";
microsoftonline.secured\m1soft\verify.php:$mail_to = "feminist008@gmail.com";
sharep\final.php:$send = "steveaustin1234@gmail.com";



http://uahowias.com/12.zip
http://zahwes.com/microsoftonline.secured.zip
http://qtoksa.com/verify.login.microsoftonline/sharep.zip
http://taowlk.com/Luno/luno.zip
http://hanlskes.com/Anymail%20Magnet.zip
http://hanlskes.com/forum/Anymail%20Magnet.zip
http://hanlskes.com/invoice/Anymail%20Magnet.zip
http://hanlskes.com/admin/Anymail%20Magnet.zip
http://hanlskes.com/Confirmation/Anymail%20Magnet%20-%20zilo.zip
http://hanlskes.com/Proposal%20/Anymail%20Magnet.zip
http://kalusm.com/2019box.zip