PAYPAL phish running on nelsonmyoshop[.]com

Found: 2018-07-30 03:15:53.885000
URL: https://nelsonmyoshop.com/zht2/log.zip
File: nelsonmyoshop.com-zht2-log.zip
Domain: nelsonmyoshop.com
Target: PAYPAL
Name                                               Size Date                 MD5                                log/log/linkedin/.htaccess                         163302 2017-09-13 02:01:02  ccd6e7e7351afb0307aa7f6925a7f475
    File appears in 4 kits
log/log/linkedin/blocker.php                        2644 2017-09-13 02:01:02  5aa3f3f406ced12d0bc7742e77b01781
    File appears in 281 kits  and under 5 different file names
log/log/linkedin/index.php                           788 2017-09-13 02:01:04  0c778e74f4e38835dceab316fee394ef

log/log/linkedin/Linkedin/geoplugin.class.php       4338 2017-09-13 02:01:04  7e79e7c99462b748cb7383f0a94c7af8
    File appears in 28 kits
log/log/linkedin/Linkedin/SignIn.php               19535 2017-09-13 02:01:06  ea475b45bc8e3409336b7ac6c74c0683

log/log/linkedin/Linkedin/validate.php              1900 2018-07-30 02:31:32  2912e65cd1edec393c97d25d9dbf0ca9
log/log/linkedin/robots.txt                           26 2017-09-13 02:01:04  bbbcde0b15cabd06aace1df82d335978
    File appears in 155 kits  and under 2 different file names
log/log/linkedin/vu.txt                               70 2017-09-13 02:01:04  194400f715893a5797252e23979b78f1


3 Email addresses found:
    team_pbg@yahoo.com (appears in 39 kits)
    okwulu1@gmail.com
    okwulu1@zoho.com



https://texasmalwareblog.blogspot.com   @phish_total