Where the PHISHING was alerted: https://urlquery.net/report/8d62ef02-4c5e-4988-aa1e-d00a8a76af8f
Re: http://www.isithacked.com/check/envion.live%2F
Suspended: -http://envion.live/cgi-sys/suspendedpage.cgi
Detected there: https://www.virustotal.com/nl/url/f9eb0a17676f555e4487997f6a5b23892a94aacbe002557d4db6c05854736960/analysis/1514164619/
The downloaded file is just flagged by one: https://www.virustotal.com/nl/file/17fa2f3324d45c27a318ed51dab739c7f09b573185b76889b955ad2c9ad1d7b8/analysis/1514140704/
polonus