WEBMAIL phish running on geogospeltroupe[.]com

Found: 2017-12-19 19:15:05.339000
URL: http://geogospeltroupe.com/wp-includes/Requests/Auth/2/chines.zip
File: geogospeltroupe.com-2-chines.zip
Domain: geogospeltroupe.com
Target: WEBMAIL
Name                                               Size Date                 MD5                                chines/chines/geoplugin.class.php                   4493 2012-12-30 22:25:56  1e63694db090c37403b39236526ce9dd
    File appears in 78 kits
chines/chines/hellion/logos.png                    41796 2015-11-19 10:18:46  da29b5868f74377ff10b5893685cf643
    File appears in 39 kits
chines/chines/hellion/postmaster.png                5496 2015-11-19 10:18:46  c1ead276fc29903252146f2d6e90beae
    File appears in 39 kits
chines/chines/index.php                             4154 2015-11-19 10:37:56  f613ce90b8aa73369439fcd308b5f305
    File appears in 38 kits
chines/index.php                                     812 2016-10-23 19:00:46  951e9d0dd7d4f7d771e36ef743b3043d
    File appears in 5 kits
chines/chines/auth.php                               729 2017-08-07 08:53:28  831b8444765be3a449752bd08acc5daa


3 Email addresses found:
    gp_support@geoplugin.com (appears in 1008 kits)
    stumpfilvan1@gmail.com
    localhost@gmail.com



https://texasmalwareblog.blogspot.com   @phish_total