WEBMAIL phish running on servicedataonline[.]club

Found: 2018-04-04 05:16:38.715000
URL: http://servicedataonline.club/any/163.zip
File: servicedataonline.club-any-163.zip
Domain: servicedataonline.club
Target: WEBMAIL
Name                                               Size Date                 MD5                                163/Attachments_2017118/geoplugin.class.php         4493 2017-08-31 08:50:10  1e63694db090c37403b39236526ce9dd
    File appears in 98 kits
163/Attachments_2017118/index.php                   1685 2017-09-01 01:34:52  f3141868fecf1548b7c83e9f926beef0
163/Attachments_2017118/post.php                    1006 2017-08-31 08:51:00  fe006e2f7283f7945c3bf417f7e3ec05
163/geoplugin.class.php                             4647 2017-09-01 09:15:52  c8ea1e960b48a620c00bc65d525a721c
    File appears in 1266 kits  and under 3 different file names
163/index.php                                       1703 2018-04-04 07:02:12  8f2c01d87a783cd1adcc92462f89f6b6
163/post.php                                        1003 2018-03-13 17:08:04  be2e14e8254a466abffe06d1feb7e54a

4 Email addresses found:
    gp_support@geoplugin.com (appears in 1197 kits)
    vpol444@gmail.com
    ddonwise1000@yandex.com
    g.2sulukdze@gmail.com



https://texasmalwareblog.blogspot.com   @phish_total