WEBMAIL phish running on hairlosetreatment[.]com

Found: 2018-08-23 15:15:07.300000
URL: http://hairlosetreatment.com/x-ray/china.zip
File: hairlosetreatment.com-x-ray-china.zip
Domain: hairlosetreatment.com
Target: WEBMAIL
Name                                               Size Date                 MD5                                china/china/china/china/china/china/china/china/auth.php  1061 2018-08-21 02:17:48  81304c1b76a3734808ecd0ef324b620b
    File appears in 15 kits
china/china/china/china/china/china/china/china/geoplugin.class.php  4493 2018-02-23 01:21:54  1e63694db090c37403b39236526ce9dd
    File appears in 112 kits
china/china/china/china/china/china/china/china/hellion/logos.png 41796 2018-02-23 01:21:54  da29b5868f74377ff10b5893685cf643
    File appears in 70 kits
china/china/china/china/china/china/china/china/hellion/postmaster.png  5496 2018-02-23 01:21:54  c1ead276fc29903252146f2d6e90beae
    File appears in 70 kits
china/china/china/china/china/china/china/china/hellion/Thumbs.db 11264 2018-02-23 01:21:56  832925e864b199eb8f612b1ebac41669
    File appears in 44 kits
china/china/china/china/china/china/china/china/index.php  4154 2018-02-23 01:21:54  f613ce90b8aa73369439fcd308b5f305
    File appears in 67 kits

2 Email addresses found:
    boltlogs111@gmail.com (appears in 11 kits)
    gp_support@geoplugin.com (appears in 1279 kits)



https://texasmalwareblog.blogspot.com   @phish_total