2018-11-02 phishing kit threat actors 176.31.101.96

http://pastebin.com/raw/LHWHQfSy

found by @Dashowl and @techhelplist
#phishing kits and threat actors at
176.31.101.96 @ovh hosting

https://twitter.com/Techhelplistcom/status/1058396564518064128
https://twitter.com/Dashowl/status/1058391810828128257

kits\cvc\cvc1\ddcunoffice\ddcun\Docun\1b8a2b62eb2fc599359ece6d54c36663\mobile.php:$to = "[email protected]";
kits\cvc\cvc1\ddcunoffice\ddcun\Docun\1b8a2b62eb2fc599359ece6d54c36663\os.php:$to = "[email protected]";
kits\cvc\cvc1\ddcunoffice\ddcun\Docun\3c95063d88639fafdcd8ab43313b8563\mobile.php:$to = "[email protected]";
kits\cvc\cvc1\ddcunoffice\ddcun\Docun\3c95063d88639fafdcd8ab43313b8563\os.php:$to = "[email protected]";
kits\cvc\cvc1\ddcunoffice\ddcun\Docun\4d4e3446a19a9f0bdf0075fb1663fc76\mobile.php:$to = "[email protected]";
kits\cvc\cvc1\ddcunoffice\ddcun\Docun\4d4e3446a19a9f0bdf0075fb1663fc76\os.php:$to = "[email protected]";
kits\cvc\cvc1\ddcunoffice\ddcun\Docun\62d968f70338e01b047d6b1b6678609b\mobile.php:$to = "[email protected]";
kits\cvc\cvc1\ddcunoffice\ddcun\Docun\62d968f70338e01b047d6b1b6678609b\os.php:$to = "[email protected]";
kits\cvc\cvc1\ddcunoffice\ddcun\Docun\7faec1e8708ef381f7d7dca045380076\mobile.php:$to = "[email protected]";
kits\cvc\cvc1\ddcunoffice\ddcun\Docun\7faec1e8708ef381f7d7dca045380076\os.php:$to = "[email protected]";
kits\cvc\cvc1\ddcunoffice\ddcun\Docun\8890619def61ef44060f378fdc5ea0b0\mobile.php:$to = "[email protected]";
kits\cvc\cvc1\ddcunoffice\ddcun\Docun\8890619def61ef44060f378fdc5ea0b0\os.php:$to = "[email protected]";
kits\cvc\cvc1\ddcunoffice\ddcun\Docun\8c435786d93953904671f57973bb10be\mobile.php:$to = "[email protected]";
kits\cvc\cvc1\ddcunoffice\ddcun\Docun\8c435786d93953904671f57973bb10be\os.php:$to = "[email protected]";
kits\cvc\cvc1\ddcunoffice\ddcun\Docun\918dc480e9f4f9948be20b1f98bece1c\mobile.php:$to = "[email protected]";
kits\cvc\cvc1\ddcunoffice\ddcun\Docun\918dc480e9f4f9948be20b1f98bece1c\os.php:$to = "[email protected]";
kits\cvc\cvc1\ddcunoffice\ddcun\Docun\96cfc98e957dca66e272529ae4567b5b\mobile.php:$to = "[email protected]";
kits\cvc\cvc1\ddcunoffice\ddcun\Docun\96cfc98e957dca66e272529ae4567b5b\os.php:$to = "[email protected]";
kits\cvc\cvc1\ddcunoffice\ddcun\Docun\9987eeccb4f037a9a4ad60c17ed038da\mobile.php:$to = "[email protected]";
kits\cvc\cvc1\ddcunoffice\ddcun\Docun\9987eeccb4f037a9a4ad60c17ed038da\os.php:$to = "[email protected]";
kits\cvc\cvc1\ddcunoffice\ddcun\Docun\af70b6966adb189f17a2144da6f94a9b\mobile.php:$to = "[email protected]";
kits\cvc\cvc1\ddcunoffice\ddcun\Docun\af70b6966adb189f17a2144da6f94a9b\os.php:$to = "[email protected]";
kits\cvc\cvc1\ddcunoffice\ddcun\Docun\d47addc73fb063158f35e579345a9c58\mobile.php:$to = "[email protected]";
kits\cvc\cvc1\ddcunoffice\ddcun\Docun\d47addc73fb063158f35e579345a9c58\os.php:$to = "[email protected]";
kits\cvc\cvc1\ddcunoffice\ddcun\Docun\Docu\mobile.php:$to = "[email protected]";
kits\cvc\cvc1\ddcunoffice\ddcun\Docun\Docu\os.php:$to = "[email protected]";
kits\office2018\office\info.php:$recipient = "[email protected]";
kits\office2018\office\verify.php:$recipient = "[email protected]";
kits\Permission%20_1\drive\alphp.php:$to = "[email protected]";
kits\Permission%20_1\drive\offphp.php:$to = "[email protected]";
kits\Permission%20_1\drive\oph.php:$to = "[email protected]";
kits\Permission%20_1\drive\verification.php:$to = "[email protected]";