MICROSOFT phish running on royaltyappliances[.]com

Found: 2018-02-01 10:07:53
URL: http://royaltyappliances.com/Securedrive/Purchasing.zip
File: Purchasing-royaltyappliances.com.zip
Domain: royaltyappliances.com
Target: MICROSOFT
Name                                               Size Date                 MD5                                Purchasing/block.php                                1554 2014-07-25 08:49:26  5116adad80c341b85d93671a323a55af
    File appears in 254 kits  and under 2 different file names
Purchasing/index.php                                2005 2016-12-08 13:50:16  1e9e0670f7ae2981fb9e9e9458a4622b

Purchasing/log/browser.php                          1426 2013-06-19 00:12:56  f68eba4c1d2ac92fd26070ae72df8deb
    File appears in 237 kits
Purchasing/log/index.php                            1554 2013-08-20 07:34:38  5116adad80c341b85d93671a323a55af
    File appears in 254 kits  and under 2 different file names
Purchasing/log/log.php                              2198 2013-06-18 23:54:14  aa7fcb73817b433342d4f82d2412b18a
    File appears in 236 kits
Purchasing/log/log.zip                              3425 2014-07-25 08:48:26  be3eb2db56cefce7b2de6f838cf6d095
    File appears in 98 kits
Purchasing/log/logs.txt                            229781 2015-06-17 17:14:30  bcd8f5a59cdbd58de113560c035ed082
    File appears in 77 kits
Purchasing/log/os.php                               1556 2013-06-19 00:18:26  4aa01e4749d0a0048dd966e039d02839
    File appears in 237 kits
Purchasing/Onedrive/index.php                      31480 2016-12-15 22:45:46  f8a4c5acd527bda34491c6e4b371f4de

Purchasing/Onedrive/Purchasing.pdf                 733527 2017-09-15 15:15:16  7672ba8326f6e0804f72469b005517d8
    File appears in 2 kits  and under 2 different file names
Purchasing/Onedrive/verification.php                 441 2018-01-04 10:35:06  1f67cf305f294db82483928a5475229d

Purchasing/robots.txt                                730 2014-06-11 00:50:58  0e5669c5314e2c3c273e52956a0c81bf
    File appears in 144 kits

1 Email addresses found:
    iampaddya@gmail.com



https://texasmalwareblog.blogspot.com   @phish_total