WEBMAIL phish running on groundzero-tga[.]com

Found: 2018-07-28 08:15:35.913000
URL: https://groundzero-tga.com/webadmin/china.zip
File: groundzero-tga.com-webadmin-china.zip
Domain: groundzero-tga.com
Target: WEBMAIL
Name                                               Size Date                 MD5                                china/auth.php                                      1059 2017-03-31 01:19:44  db259941907585834a0f7c5413c42333

china/geoplugin.class.php                           4493 2012-12-31 06:25:56  1e63694db090c37403b39236526ce9dd
    File appears in 112 kits
china/hellion/logos.png                            41796 2015-11-19 18:18:46  da29b5868f74377ff10b5893685cf643
    File appears in 70 kits
china/hellion/postmaster.png                        5496 2015-11-19 18:18:46  c1ead276fc29903252146f2d6e90beae
    File appears in 70 kits
china/hellion/Thumbs.db                            11264 2016-11-13 23:37:54  832925e864b199eb8f612b1ebac41669
    File appears in 44 kits
china/index.php                                     4154 2015-11-19 18:37:56  f613ce90b8aa73369439fcd308b5f305
    File appears in 67 kits

2 Email addresses found:
    worrylogs@gmail.com (appears in 3 kits)
    gp_support@geoplugin.com (appears in 1279 kits)



https://texasmalwareblog.blogspot.com   @phish_total