2018-01-15 Phishing Kits from Phish Tank

hunting #phishing kits
19 more from the depths of the @PhishTank_Bot
23 threat actor emails
all phishing kits were still available just a bit ago

@neonprimetime security

http://armtrans.com.au/wp.includes/DHLAUTO.zip
http://armtrans.com.au/wp.includes/wwe.zip
http://freethingstodoinmiami.com/wp-includes/google.zip
http://gkcpsc.edu.bd/amnsiteline.inc.zip
http://mmc-mail.info/Account-security.zip
http://nobrecargo.com.br/wp-includes/js/giwa.zip
http://phukienbachgia.net/work/resources/files/dropbox_2017%20(2).zip
http://qponn.net/configuration/wealth.zip
http://rashtriyasevatrust.com/ona.zip
http://rashtriyasevatrust.com/shortwells2016.zip
http://saba60.com/brewthru.com/tvx1210rj43.zip
http://sahare.planeblackbuilders.com.au/SPERROW%20PY%20_1%20(2).zip
http://souvenirkaretbdg.com/wp-includes/fonts/homes/hardproxy/newfile/update/chines001.zip
http://sporul.ro/INVOICES//INVOICES/googledoc.new.zip
http://tetradthailand.net/admin/mani.zip
http://www.aykensdrafting.com.au/wp-images/admin/english.zip
http://www.aykensdrafting.com.au/wp-images/admin/newadobe.zip
http://www.homeapplianceservices.org/wp-content/plugins/css-ready-selectors/black/hotis.zip
https://serviceactivation-page2018.000webhostapp.com/page2018/bayar.zip

6e730deaae123c9b084e1f4a363f36f2  C:\Users\Research\Desktop\Account-security.zip
bb3ab6be3e71a87f721063c684738448  C:\Users\Research\Desktop\amnsiteline.inc.zip
e81275dcf74bdd6246689030806af1b4  C:\Users\Research\Desktop\bayar.zip
6e98d35fc5483ff322cd6c08841651bd  C:\Users\Research\Desktop\chines001.zip
649a41a514693e0ddb3e73fc59d64472  C:\Users\Research\Desktop\DHLAUTO.zip
56be2c4d90e95216c7229627c5dcf21e  C:\Users\Research\Desktop\dropbox_2017%20(2).zip
03e2c5eb1e56bbac6c5b1d5c3ea2bbe4  C:\Users\Research\Desktop\english.zip
e119702f3fb6a535d0021526224b0c19  C:\Users\Research\Desktop\giwa.zip
a32cf06d6dbc7648f618b41895edf9b6  C:\Users\Research\Desktop\google.zip
0e7a2e02748b15323638e53c73f8dd66  C:\Users\Research\Desktop\hotis.zip
78155a04200f5b939f3dd912c8973518  C:\Users\Research\Desktop\mani.zip
34978e335d10a030c7e6c40ea963740d  C:\Users\Research\Desktop\newadobe.zip
8c2b2dacbdc119376597afa388ad08ed  C:\Users\Research\Desktop\ona.zip
43e0ed4c02a5b13c4574b03d4f144c89  C:\Users\Research\Desktop\shortwells2016.zip
d83bf2c010a797bc1b9b128d7768dc18  C:\Users\Research\Desktop\SPERROW%20PY%20_1%20(2).zip
bb18352ee39173e4f9c748ab31e044b3  C:\Users\Research\Desktop\tvx1210rj43.zip
83a5d087cf148aa459c1c94c411172f8  C:\Users\Research\Desktop\wealth.zip
595a55bec252f5288b0edab38b54743a  C:\Users\Research\Desktop\wwe.zip

threat actor emails
$send = "nicolasoscar1@zoho.com";
$to = "meek.omelly@yandex.com";
$recipient ="swaelee180@gmail.com";
$emailusr = 'freshvelalogin@gmail.com';
$send = "boxr319@gmail.com";
$sent ="dnichls177@gmail.com";
$sent ="checksandbalances77@gmail.com";
$to = "loeverr@addenda.com.pl";
$send = "resultbox20@yandex.com,legzyresult@gmail.com,legzyresult@zoho.com,legzydaboss@mail.ru,legzyresult@excite.com";
$to = "myresultbox7410@gmail.com";
mail("akasdonald@gmail.com",$subj,$message,$from,$domain);
mail("susanging1141@gmail.com",$subj,$message,$from,$domain);
$to = "loeverr@addenda.com.pl";
$recipient = "blessed.muno1@gmail.com";
$own = 'blessed.muno1@gmail.com';
$to = spammingwireresult101@gmail.com";
$to = "Collins.baker1231@gmail.com";
$send = "instantepay@gmail.com,repmore010@outlook.com";

$bannedIP = array("^66.102.*.*", "^66.249.*.*", "^72.14.192.*", "^109.67.197.*", "^74.125.*.*", "^209.85.128.*", "^216.239.32.*", "^74.125.*.*", "^207.126.144.*", "^173.194.*.*", "^64.233.160.*", "^72.14.192.*", "^66.102.*.*", "^64.18.*.*", "^194.52.68.*", "^194.72.238.*", "^62.116.207.*", "^212.50.193.*", "^69.65.*.*", "^50.7.*.*", "^131.212.*.*", "^46.116.*.* ", "^62.90.*.*", "^89.138.*.*", "^82.166.*.*", "^85.64.*.*", "^85.250.*.*", "^89.138.*.*", "^93.172.*.*", "^109.186.*.*", "^194.90.*.*", "^212.29.192.*", "^212.29.224.*", "^212.143.*.*", "^212.150.*.*", "^212.235.*.*", "^217.132.*.*", "^50.97.*.*", "^217.132.*.*", "^209.85.*.*", "^66.205.64.*", "^204.14.48.*", "^64.27.2.*", "^67.15.*.*", "^202.108.252.*", "^193.47.80.*", "^64.62.136.*", "^66.221.*.*", "^64.62.175.*", "^198.54.*.*", "^192.115.134.*", "^216.252.167.*", "^193.253.199.*", "^69.61.12.*", "^64.37.103.*", "^38.144.36.*", "^64.124.14.*", "^206.28.72.*", "^209.73.228.*", "^158.108.*.*", "^168.188.*.*", "^66.207.120.*", "^167.24.*.*", "^192.118.48.*", "^67.209.128.*", "^12.148.209.*", "^12.148.196.*", "^193.220.178.*", "68.65.53.71", "^198.25.*.*", "^64.106.213.*");