ALIBABA phish running on cristinaferrarecooks[.]com

Found: 2018-08-29 18:15:05.121000
URL: http://cristinaferrarecooks.com/wp-content/mu-plugins/www.loginalibaba.com.zip
File: cristinaferrarecooks.com-mu-plugins-www.loginalibaba.com.zip
Domain: cristinaferrarecooks.com
Target: ALIBABA
Name                                               Size Date                 MD5                                www.loginalibaba.com/www.loginalibaba.com/alibaba/alibaba/images/img1.jpg 62536 2017-11-06 07:21:08  1ff5fecfc48a0ade68d4f71c01f39447
    File appears in 22 kits
www.loginalibaba.com/www.loginalibaba.com/alibaba/alibaba/images/img2.png 335152 2017-11-06 07:21:08  bb34415167f5776f8918e004bd05ab0d
    File appears in 176 kits  and under 2 different file names
www.loginalibaba.com/www.loginalibaba.com/alibaba/alibaba/images/img3.gif  1380 2017-11-06 07:21:08  de1d32379d27e9caa603ee7fdbfcc4e2
    File appears in 187 kits  and under 2 different file names
www.loginalibaba.com/www.loginalibaba.com/alibaba/alibaba/images/img4.gif 59977 2017-11-06 07:21:08  62db9d89ce236e6410884ecb6e803f0c
    File appears in 164 kits
www.loginalibaba.com/www.loginalibaba.com/alibaba/alibaba/images/Thumbs.db 10752 2017-11-06 07:21:08  ab70cfa9398e49b27437bd05540f4ed5
    File appears in 159 kits
www.loginalibaba.com/www.loginalibaba.com/alibaba/alibaba/login.alibaba.com.php  6679 2017-11-06 07:21:08  dfb376dc08de10a6a99d95dffec0b2de
    File appears in 55 kits  and under 4 different file names
www.loginalibaba.com/www.loginalibaba.com/alibaba/alibaba/post1.php   712 2017-11-06 07:21:56  22ff298463073b85235a8f977ece68c0
    File appears in 3 kits

1 Email addresses found:
    callmepog101@gmail.com (appears in 3 kits)



https://texasmalwareblog.blogspot.com   @phish_total