MICROSOFT phish running on freethelovelyyou[.]com

Found: 2017-12-19 07:22:24.240000
URL: http://freethelovelyyou.com/Blog/wp-content/plugins/Gallery/alibi/hotnail.zip
File: freethelovelyyou.com-alibi-hotnail.zip
Domain: freethelovelyyou.com
Target: MICROSOFT
Name                                               Size Date                 MD5                                hotnail/hotnail/3d.php                              3735 2017-12-05 17:00:50  f4109a882cad282df5a4f1150f8267d7
hotnail/hotnail/files/logo.svg                       379 2017-10-27 08:40:10  2d8f86059be176833897099ee6ddedeb
    File appears in 3 kits
hotnail/hotnail/files/x3d.php                      115325 2017-10-27 08:40:12  7e4d32d3d2f470084c7bf91bc5ed24fe
hotnail/hotnail/files/x3dleaf.php                  152856 2017-10-27 08:40:12  7212087a06ce3d0d6c3467316bfa841a
hotnail/hotnail/files/x4d.php                      35758 2017-10-27 08:40:12  f43cf95a5b19f48a9dff32d518b395dc
    File appears in 15 kits
hotnail/hotnail/index.php                           1013 2017-10-27 08:40:14  9af0fe33b0c7ac0ed29ec26b65c95eaa
hotnail/hotnail/login.php                          18705 2017-10-27 08:40:14  770c6275aa84e9c02f6f29f6fc99e5da
hotnail/hotnail/pro3Drender.php                    20812 2017-10-30 05:55:02  9265fd4015f81e0df7858965061e8bd1

7 Email addresses found:
    'windowslive2000@gmail.com
    'info@rmail-protector.gerilja.no
    op-sfqmzbddpvout.hpphmf.dpny4ecbtfhnbjm.dpn@scoutcamp.bounces.google.com
    'joe@example.com (appears in 131 kits)
    'zoe@example.com (appears in 131 kits)
    '@phpmailer.0 (appears in 131 kits)
    user@domain.com



https://texasmalwareblog.blogspot.com   @phish_total