NATWEST phish running on weicreative.com

Found: 2017-11-26 04:16:17.863000
URL: http://weicreative.com/wp-includes/js/nw0lb.zip
File: weicreative.com-js-nw0lb.zip
Domain: weicreative.com
Target: NATWEST
Name                                               Size Date                 MD5                                nw0lb/nw0lb/a5px.html                              18952 2017-10-10 11:20:40  b805dca6f227e886509705f9b3202a22
nw0lb/nw0lb/inc/favicon.ico                         2238 2017-10-10 11:20:40  d0ab1861f850d4514edaa1696b3b5ce2
    File appears in 7 kits  and under 2 different file names
nw0lb/nw0lb/inc/fonts/RNHouseSansW01-Bold.eot      39076 2017-10-10 11:20:40  6d679c9b2899f193346257cfecc7d36f
    File appears in 3 kits
nw0lb/nw0lb/inc/fonts/RNHouseSansW01-Bold.svg      65870 2017-10-10 11:20:40  c9fa0919e7bc532a7337f563082254b9
    File appears in 3 kits
nw0lb/nw0lb/inc/fonts/RNHouseSansW01-Bold.ttf      38852 2017-10-10 11:20:40  3e1e1ccecec4136fee508c64eed9ab61
    File appears in 3 kits
nw0lb/nw0lb/inc/fonts/RNHouseSansW01-Bold.woff     23120 2017-10-10 11:20:40  5996cc08faa69532bb8279857513d849
    File appears in 3 kits
nw0lb/nw0lb/inc/fonts/RNHouseSansW01-Regular.eot   39316 2017-10-10 11:20:40  362d3db5f6d54ce5391a5f9048b50b2d
    File appears in 3 kits
nw0lb/nw0lb/inc/fonts/RNHouseSansW01-Regular.svg   67540 2017-10-10 11:20:40  2c7d633c8037c68917bc24b91fb68bf2
    File appears in 3 kits
nw0lb/nw0lb/inc/fonts/RNHouseSansW01-Regular.ttf   39080 2017-10-10 11:20:40  72028f3887aaa33e9d35bfd15dafe920
    File appears in 3 kits
nw0lb/nw0lb/inc/fonts/RNHouseSansW01-Regular.woff  22688 2017-10-10 11:20:40  716f2ca9f67d3d4f51c514b135a8580b
    File appears in 3 kits
nw0lb/nw0lb/inc/npc_new.css                        37189 2017-10-10 11:20:40  8cae47a597a2496027bd56e2c0326123
    File appears in 3 kits
nw0lb/nw0lb/index.php                                316 2017-10-10 11:20:40  ec1db49f4bfbe185dadb09f4b35c4880
nw0lb/nw0lb/login.aspx.php                         36736 2017-10-10 11:20:40  93e6a30dc8436049e79e399306c35d81
nw0lb/nw0lb/logon.php                                899 2017-10-10 11:21:20  d7e70d9d60ce14d3dd3807b9d91a8321

2 Email addresses found:
    donitalkotalking@yahoo.com
    embership@natwest.com



https://texasmalwareblog.blogspot.com   @phish_total