WEBMAIL phish running on 000webhostapp[.]com

Found: 2018-01-24 04:15:21.654000
URL: http://scrimpy-tars.000webhostapp.com/web/VALIDATE%20NOW.zip
File: scrimpy-tars.000webhostapp.com-web-VALIDATE%20NOW.zip
Domain: 000webhostapp.com
Target: WEBMAIL
Name                                               Size Date                 MD5                                VALIDATE NOW/index.htm                               127 2012-11-28 05:57:40  ed9d6e04a557423f14a5cf467c8efb6e
    File appears in 23 kits
VALIDATE NOW/mail.htm                               1593 2013-09-04 17:06:46  9b9c9a0d3d4410e57cc9241aa842acf5
    File appears in 23 kits
VALIDATE NOW/up.php                                  917 2016-04-28 22:25:34  12ed20669cf0b3ba7d2d4277cc7b09a5
    File appears in 16 kits
VALIDATE NOW/validation.html                         930 2013-09-04 17:24:40  10c641abb8539cae6d2d6b1821584b24
    File appears in 23 kits  and under 2 different file names

2 Email addresses found:
    'postmasterlog@gmail.com (appears in 16 kits)
    irus@amaslim.com (appears in 17 kits)



https://texasmalwareblog.blogspot.com   @phish_total