WEBMAIL phish running on change[.]me[.]ke

Found: 2018-04-03 09:17:48.602000
URL: https://change.me.ke/wp-admin/includes/validate.zip
File: change.me.ke-includes-validate.zip
Domain: change.me.ke
Target: WEBMAIL
Name                                               Size Date                 MD5                                validate/index.htm                                   127 2017-08-01 13:24:12  ed9d6e04a557423f14a5cf467c8efb6e
    File appears in 26 kits
validate/mail.htm                                   1593 2017-08-01 13:23:58  9b9c9a0d3d4410e57cc9241aa842acf5
    File appears in 26 kits
validate/up.php                                      960 2018-03-29 14:51:20  e2b8b58fcfe4023b1b24fcf0ef39bb36
validate/validate/index.htm                          127 2017-08-01 13:24:12  ed9d6e04a557423f14a5cf467c8efb6e
    File appears in 26 kits
validate/validate/mail.htm                          1593 2017-08-01 13:23:58  9b9c9a0d3d4410e57cc9241aa842acf5
    File appears in 26 kits
validate/validate/up.php                             984 2017-12-11 18:35:26  7cd432eb3e503d1acc4e924c06043f2d

validate/validate/validation.html                    930 2017-08-01 13:23:48  10c641abb8539cae6d2d6b1821584b24
    File appears in 26 kits  and under 2 different file names
validate/validation.html                             930 2017-08-01 13:23:48  10c641abb8539cae6d2d6b1821584b24
    File appears in 26 kits  and under 2 different file names

4 Email addresses found:
    'kelvin.thomas0003@gmail.com
    liamscoker42@zoho.com
    'ultimateresult@amaslim.com
    kelvinthomas@yandex.com



https://texasmalwareblog.blogspot.com   @phish_total