PayPal phish running on 000webhostapp[.]com

Found: 2018-03-25 22:15:41.084000
URL: http://klomentr.000webhostapp.com/uay.zip
File: klomentr.000webhostapp.com-foo-uay.zip
Domain: 000webhostapp.com
Target: PayPal
Name                                               Size Date                 MD5                                uay/10.71.184.6_8080/www/default/base.js            2744 2016-02-27 01:06:06  2ddc0af55b877d0ddcb9443a65bf84c2
    File appears in 4 kits
uay/backblue.gif                                    4243 2018-02-26 14:47:32  4f7f4833de227ed0e6b58eafd7393503
    File appears in 5 kits
uay/fade.gif                                         828 2018-02-26 14:47:32  4bc48ce355acd4732f33a79e29728e96
    File appears in 4 kits
uay/hts-cache/doit.log                               712 2018-02-26 14:47:32  f33d7cb8b7645f0096e3ad5daba0f8a9
uay/hts-cache/new.lst                                776 2018-02-26 14:47:44  b0cad94b2a73fa431cc1f986dd66bc65
uay/hts-cache/new.txt                               3821 2018-02-26 14:47:44  1f759162a3638b246660573bf70f5751
uay/hts-cache/new.zip                              10948 2018-02-26 14:47:44  17c9b0eeb1aef2332c0c06689822911e
uay/hts-cache/readme.txt                             615 2018-02-26 14:47:32  7704811baa227d3928fd9cdd964af5a1
    File appears in 2 kits
uay/hts-cache/winprofile.ini                        1341 2018-02-26 14:47:32  c89cf6c2a10d2775144703c99a2f9c58
uay/hts-log.txt                                     2477 2018-02-26 14:47:44  394286a7dc664413fad9e9d2d0ba8795
uay/i/Payment reference/images/bg_form.png           353 2018-02-26 14:47:44  a9d40b151ebf0dafdb91ad72677688da
uay/i/Payment reference/images/warning.html          353 2018-02-26 14:47:40  b83fe830da52d85afb37c9ed469855cd
uay/i/Payment reference/include/Acrobat_Reader.fw.png 61022 2017-03-07 03:46:34  030155fb903e3526ae4d460f131eab65
    File appears in 11 kits
uay/i/Payment reference/include/adobe_logo_new_1.jpg 22186 2017-03-07 03:46:34  92fb23a4e353350002cb72e5d6092b02
    File appears in 11 kits
uay/i/Payment reference/include/secure.png         56295 2017-03-07 03:46:34  9da00e7d1ce45e16ede4380159617637
    File appears in 13 kits  and under 2 different file names
uay/i/Payment reference/include/SpryValidationTextField.css  3070 2017-03-07 03:46:34  43470e0833122b511010559527e2ae91
uay/i/Payment reference/include/SpryValidationTextField.js.download 75184 2017-03-07 03:46:34  a87a2350e9140f31402b5ab5a60e5d69
    File appears in 10 kits
uay/i/Payment reference/include/style.css           4255 2018-02-24 18:11:08  7abdb4e55023ecc95ed9d1bbf394e524
uay/i/Payment reference/index.html                  6738 2018-02-26 14:45:04  867c16dc3a6a8f1ea8ae1fc78c87f637
uay/i/Payment reference/index.php                   6785 2018-03-13 09:27:02  249356bed554196b3eed49520127b067
uay/i/Payment reference/req.php                     2613 2018-03-13 09:50:08  06f1c99168dc6887a4a7ca4a35b7c804
uay/i/Payment reference/timeout.php                 6908 2018-03-13 09:29:20  aa95ffda41ffcd0bc5517f0f483f5d87
uay/index.html                                      5279 2018-02-26 14:47:38  f9141d61cca2ac55c8170b03f98db08f

2 Email addresses found:
    'payrealsys@gmail.com
    no_reply@mylinklog.com (appears in 4 kits)



https://texasmalwareblog.blogspot.com   @phish_total