MICROSOFT phish running on lewanai[.]tk

Found: 2018-03-23 02:23:44.149000
URL: http://lewanai.tk/secured/officedocs/Officeand365.zip
File: lewanai.tk-officedocs-Officeand365.zip
Domain: lewanai.tk
Target: MICROSOFT
Name                                               Size Date                 MD5                                Officeand365/Officeand365/blocker.php               2644 2014-12-03 06:17:00  5aa3f3f406ced12d0bc7742e77b01781
    File appears in 243 kits  and under 4 different file names
Officeand365/Officeand365/images/1.png             822800 2016-11-14 09:58:52  b4d8d1d72ed10dc78b2bb39c3432c0f5
    File appears in 8 kits
Officeand365/Officeand365/images/2.jpg             31321 2017-03-22 19:38:06  56c3b333306527ee6e77b62d8ee0ab9e
    File appears in 6 kits
Officeand365/Officeand365/images/2i.png            41118 2017-03-22 19:50:26  2fa3a1e04c4d2ee202c46ccb253c324b
    File appears in 6 kits
Officeand365/Officeand365/images/favicon.ico       17174 2016-11-14 11:49:16  12e3dac858061d088023b2bd48e2fa96
    File appears in 347 kits  and under 9 different file names
Officeand365/Officeand365/images/index.css          1996 2016-11-14 11:42:30  630d12dcaa8de9c6c2b33a2bdec5269b
    File appears in 8 kits
Officeand365/Officeand365/images/index1.css         2026 2016-11-14 14:26:52  9694d40d200eab073d8b7bb70a9d5b53
    File appears in 8 kits
Officeand365/Officeand365/images/main1_css.css      1995 2016-11-14 14:26:52  b0aac2b3d347e4a350bd3dfa46f63b94
    File appears in 31 kits  and under 3 different file names
Officeand365/Officeand365/images/main_css.css       1995 2016-11-14 11:42:30  b0aac2b3d347e4a350bd3dfa46f63b94
    File appears in 31 kits  and under 3 different file names
Officeand365/Officeand365/images/Thumbs.db         34304 2016-11-14 12:48:28  a31c370c1beb579d72180806b7f7de44
    File appears in 8 kits
Officeand365/Officeand365/index.php                 1321 2016-09-05 19:06:04  54d568572ecb837d95431e8cfd640d41
    File appears in 8 kits
Officeand365/Officeand365/Login2.php                1694 2016-11-14 15:15:00  b126218869fc14d9c7a562077554982d
    File appears in 7 kits
Officeand365/Officeand365/Logon.php                 2799 2018-03-21 23:56:14  c67553f491e4f2f576a1e8add3dee2c5

Officeand365/Officeand365/Logon2.php                2812 2018-03-21 23:56:00  8cb3ffb55e4a3180f8c3ec514041f3e0

Officeand365/Officeand365/robots.txt                1337 2016-08-07 03:33:46  ba613657ddd17df5e61d5571b9c9d681
    File appears in 110 kits
Officeand365/Officeand365/rqpozv8f9kkaow6kapwenjcw.php  1687 2017-03-22 20:00:10  65d471f5d9b0eef336b5ae38ce2dd864
    File appears in 7 kits  and under 3 different file names

3 Email addresses found:
    someone@example.com (appears in 78 kits)
    qdeelee@gmail.com
    tee@ttcpanel.com (appears in 5 kits)



https://texasmalwareblog.blogspot.com   @phish_total