MICROSOFT phish running on mentormigration[.]com[.]au

Found: 2018-04-30 03:49:21.080000
URL: http://www.mentormigration.com.au/New/live/live.zip
File: www.mentormigration.com.au-live-live.zip
Domain: mentormigration.com.au
Target: MICROSOFT
Name                                               Size Date                 MD5                                live/live/live/geoplugin.class.php                  4647 2017-08-10 02:56:52  c8ea1e960b48a620c00bc65d525a721c
    File appears in 1307 kits  and under 3 different file names
live/live/live/images/01.png                       14801 2017-08-10 02:56:56  03f4a3e68423c7c5c594e40223941141
    File appears in 14 kits
live/live/live/images/02.png                         787 2017-08-10 02:56:58  fac26b74bd13ca8ecd98875a37d155fa
    File appears in 17 kits
live/live/live/images/03.png                       13837 2017-08-10 02:56:58  0f19fff07ee77a15e87b684b34e5262b
    File appears in 14 kits
live/live/live/images/04.png                         877 2017-08-10 02:56:58  f538109d65c084d5d56b5f33eee1aac4
    File appears in 17 kits
live/live/live/images/05.png                         750 2017-08-10 02:56:58  7e537437294b406eba29931f523d47ae
    File appears in 17 kits
live/live/live/index.php                             422 2017-08-10 02:56:52  9ef6af054f32761ce929ba0f4e771d92
    File appears in 16 kits
live/live/live/index.txt                              70 2017-08-10 02:56:52  f20494a6ef686cb2b7420e967aab63d9
    File appears in 11 kits
live/live/live/login.php                            2250 2017-08-10 02:56:54  a79c23cd690f2634de5bf5c1f5dddd62
    File appears in 10 kits
live/live/live/login2.php                           3141 2017-08-10 02:56:56  40646ff90b588ed0ebd82e7cb4ba7355
    File appears in 11 kits
live/live/live/post.php                             1125 2018-04-28 04:11:58  d5327608ee64be04a910e68fbaed4304

live/live/live/robots.txt                           1337 2017-08-10 02:56:56  ba613657ddd17df5e61d5571b9c9d681
    File appears in 127 kits
live/live/live/style.css                             937 2017-08-10 02:56:56  f5f2ae6487acbff6b334dc293cc9e16f
    File appears in 14 kits

2 Email addresses found:
    gp_support@geoplugin.com (appears in 1251 kits)
    niddin06@gmail.com (appears in 2 kits)



https://texasmalwareblog.blogspot.com   @phish_total