MICROSOFT phish running on checkzip[.]tk

Found: 2018-08-14 23:15:08.742000
URL: https://checkzip.tk/12.zip
File: checkzip.tk-foo-12.zip
Domain: checkzip.tk
Target: MICROSOFT
Name                                               Size Date                 MD5                                12/12/pass.php                                     18316 2018-02-10 18:53:06  8db8ef246a13dc3e6d30aac188c1fa3a
    File appears in 23 kits
12/12/Sign in to your Microsoft account_files/AppCentipede_Microsoft.svg  7174 2017-09-21 08:15:52  aed5eb9ccea43f119a25b3b74c59c7e7
    File appears in 115 kits
12/12/Sign in to your Microsoft account_files/Default1033.css 73727 2017-09-21 08:15:44  902952e2e05ab3451fb7438bb77059fb
    File appears in 87 kits  and under 2 different file names
12/12/Sign in to your Microsoft account_files/DefaultLoginStrings1033.js.txt  9898 2017-09-21 08:15:28  b507b90640721b4e47154d97609105bc
    File appears in 83 kits  and under 2 different file names
12/12/Sign in to your Microsoft account_files/DefaultLogin_Core.js.txt 126766 2017-09-21 08:15:34  a85dcfb7c3eda9c13ad3690c2dd27822
    File appears in 82 kits  and under 2 different file names
12/12/Sign in to your Microsoft account_files/logo.jpg  3602 2017-09-21 08:15:20  885531c6229490a82386b12b01cc5553
    File appears in 68 kits
12/12/Sign in to your Microsoft account_files/Microsoft_Logotype_Gray.svg  5435 2017-09-21 08:15:12  5feaa482d83c2a69d012f9bff660d373
    File appears in 115 kits
12/12/Sign in to your Microsoft account_files/prefetch.htm  3326 2017-09-21 08:15:06  68b1e3007431d49789c66d75b9f606c6
    File appears in 68 kits
12/12/Sign in to your Microsoft account_files/prefetch_data/boot.css 159658 2017-09-21 08:17:24  30da6f6f4e2d60d8aacbe2ed1583ae7f
    File appears in 68 kits
12/12/Sign in to your Microsoft account_files/prefetch_data/boot.js.txt 650764 2017-09-21 08:17:16  3fcf01abd2872c7fe233a3abaa50e122
    File appears in 68 kits  and under 2 different file names
12/12/Sign in to your Microsoft account_files/prefetch_data/boot_002.js.txt 646615 2017-09-21 08:17:08  9c766769f81c9884d74819f3dfe915be
    File appears in 68 kits  and under 2 different file names
12/12/Sign in to your Microsoft account_files/prefetch_data/boot_003.js.htm 650184 2017-09-21 08:16:58  4cfbdab231025e8b0ee7d08368516d5c
    File appears in 68 kits  and under 2 different file names
12/12/Sign in to your Microsoft account_files/prefetch_data/boot_004.js.txt 648527 2017-09-21 08:16:50  1b403af938697ddd9ed483405ff47cd4
    File appears in 68 kits  and under 2 different file names
12/12/Sign in to your Microsoft account_files/prefetch_data/sprite1.css  7304 2017-09-21 08:16:44  7c23768ca9a97f74fc7b0486747deeaf
    File appears in 68 kits
12/12/Sign in to your Microsoft account_files/prefetch_data/sprite1.png 14983 2017-09-21 08:16:38  d502a13c4f154e9fe86802b1f0338466
    File appears in 68 kits
12/12/authenticate.php                              4072 2018-07-30 04:31:14  3bdca5d16ab03d411f507924015340c0
12/12/error.php                                    18429 2018-02-10 18:53:34  2a20f45f102fb176654abe3ce8a2b360
    File appears in 23 kits
12/12/geoplugin.class.php                           4647 2017-09-21 08:13:48  c8ea1e960b48a620c00bc65d525a721c
    File appears in 1330 kits  and under 3 different file names
12/12/index.php                                    13326 2018-02-10 18:53:20  0ef5603333d7294e103d175c5e7bb08e
    File appears in 23 kits
12/12/login.php                                     1287 2018-07-30 04:32:04  1b9ec741879b00170c4430e9d1fca58b

2 Email addresses found:
    gp_support@geoplugin.com (appears in 1279 kits)
    guce00@gmail.com



https://texasmalwareblog.blogspot.com   @phish_total