CastleCops® PayPal Phish

whois

at 06 Oct, 2008 @ 16:13:04

GeekTools Whois Proxy v5.0.4 Ready.
Checking access for 149.20.54.190... ok.
Final results obtained from whois.arin.net.
Results:

OrgName:    Yahoo
OrgID:      YHOO
Address:    701 First Ave
City:       Sunnyvale
StateProv:  CA
PostalCode: 94089
Country:    US

NetRange:   68.180.128.0 - 68.180.255.255
CIDR:       68.180.128.0/17
NetName:    A-YAHOO-US6
NetHandle:  NET-68-180-128-0-1
Parent:     NET-68-0-0-0-0
NetType:    Direct Allocation
NameServer: NS1.YAHOO.COM
NameServer: NS2.YAHOO.COM
NameServer: NS3.YAHOO.COM
NameServer: NS4.YAHOO.COM
NameServer: NS5.YAHOO.COM
Comment:
RegDate:    2006-09-22
Updated:    2007-05-02

RAbuseHandle: NETWO857-ARIN
RAbuseName:   Network Abuse
RAbusePhone:  +1-408-349-3300
RAbuseEmail:  network-abuse@cc.yahoo-inc.com

RTechHandle: NA258-ARIN
RTechName:   Netblock Admin
RTechPhone:  +1-408-349-3300
RTechEmail:  rauschen@yahoo-inc.com

OrgAbuseHandle: NETWO857-ARIN
OrgAbuseName:   Network Abuse
OrgAbusePhone:  +1-408-349-3300
OrgAbuseEmail:  network-abuse@cc.yahoo-inc.com

OrgTechHandle: NA258-ARIN
OrgTechName:   Netblock Admin
OrgTechPhone:  +1-408-349-3300
OrgTechEmail:  rauschen@yahoo-inc.com

# ARIN WHOIS database, last updated 2008-10-05 19:10
# Enter ? for additional hints on searching ARIN's WHOIS database.

Results brought to you by the GeekTools WHOIS Proxy
Server results may be copyrighted and are used with permission.
Your host (149.20.54.190) has visited 2 times today.

fetched page

at 06 Oct, 2008 @ 16:13:13
MD5 Fingerprint: 25eecc193c15c0ea041055c5baf2abf3
SHA1 Fingerprint: 9762b40f73fb2ac38d7aceb560b64af38da79a52

HTTP/1.1 200 OK
Date: Mon, 06 Oct 2008 16:13:08 GMT
Set-Cookie: BX=ead87ad4eke8k&b=3&s=hv; expires=Tue, 02-Jun-2037 20:00:00 GMT; path=/; domain=.ulds-pangypal.com
P3P: policyref="http://p3p.yahoo.com/w3c/p3p.xml", CP="CAO DSP COR CUR ADM DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA POL HEA PRE GOV"
X-Host: p2w5.geo.sp1.yahoo.com
X-INKT-URI: http://www.ulds-pangypal.com//index.html
X-INKT-SITE: http://www.ulds-pangypal.com
Last-Modified: Mon, 06 Oct 2008 13:23:42 GMT
Accept-Ranges: bytes
Content-Length: 6065
Content-Type: text/html
Age: 0
Connection: close
Server: YTS/1.17.9

<html>

<head>
<meta http-equiv="Content-Language" content="en-us">
<script language="JavaScript" src="v.js" type="text/javascript"></script>
<title>Resolution Center Log In -PayPal</title>
</head>

<table cellspacing="0" cellpadding="0" width="362">
<tr>
       <td valign="top" align="right" width="152" style="font-size: 11px; font-family: verdana,arial,helvetica,sans-serif; font-weight: 400; color: 000" >&nbsp;</td>
       <td width="210" style="font-size: 11px; font-family: verdana,arial,helvetica,sans-serif; font-weight: 400; color: 000">&nbsp;</td>
</tr>
<tr>
       <td valign="top" align="right" width="152" style="font-size: 11px; font-family: verdana,arial,helvetica,sans-serif; font-weight: 400; color: 000" >&nbsp;</td>
       <td width="210" style="font-size: 11px; font-family: verdana,arial,helvetica,sans-serif; font-weight: 400; color: 000">&nbsp;</td>
</tr>
<tr>
       <td valign="top" align="right" width="152" style="font-size: 11px; font-family: verdana,arial,helvetica,sans-serif; font-weight: 400; color: 000" ><b>
       <font face="Arial">Email Address:&nbsp;</font>&nbsp;</td>
       <td width="210" style="font-size: 11px; font-family: verdana,arial,helvetica,sans-serif; font-weight: 400; color: 000">
       <input type="text" name="login" size="32"><table cellSpacing="0" cellPadding="0" align="left" border="0" width="172">
         <tr>
           <td width="8" style="font-size: 11px; font-family: verdana,arial,helvetica,sans-serif; font-weight: 400; color: 000">&nbsp;</td>
           <td width="8" style="font-size: 11px; font-family: verdana,arial,helvetica,sans-serif; font-weight: 400; color: 000">
           &nbsp;</td>
           <td width="156" style="font-size: 11px; font-family: verdana,arial,helvetica,sans-serif; font-weight: 400; color: 000">
           <span class="hint">(e.g. name@domain.com)</span></td>
         </tr>
       </table>
       </td>
</tr>
<tr>
  <td height="14" width="152" style="font-size: 11px; font-family: verdana,arial,helvetica,sans-serif; font-weight: 400; color: 000"></td></tr>
<tr>
       <td valign="top" align="right" width="152" style="font-size: 11px; font-family: verdana,arial,helvetica,sans-serif; font-weight: 400; color: 000"><b>
       <font face="Arial">PayPal Password:&nbsp;</font>&nbsp;</td>
       <td width="210" style="font-size: 11px; font-family: verdana,arial,helvetica,sans-serif; font-weight: 400; color: 000">
       <input type="password" name="password" size="33"><br>
	   &nbsp;</td>
</tr>
</table>
	   
	   </td>
</tr>
</table>
<table width="368" align="center" height="40">
<tr>
  <td align="right" width="362" style="font-size: 11px; font-family: verdana,arial,helvetica,sans-serif; font-weight: 400; color: 000" height="26"><input type="submit" name="submit" value="Log In">&nbsp;&nbsp;&nbsp;</td></tr>
<tr>
  <td align="right" width="362" style="font-size: 11px; font-family: verdana,arial,helvetica,sans-serif; font-weight: 400; color: 000" height="6" valign="top"></td></tr>
</table>
</form>

var frmvalidator = new Validator("login");
 frmvalidator.addValidation("password","req","Please enter your password");
 frmvalidator.addValidation("password","minlen=8","Please enter your correct password");
 frmvalidator.addValidation("login","req","Please enter your PayPal User ID");
 frmvalidator.addValidation("login","minlen=6","Please enter your correct PayPal User ID");
 frmvalidator.addValidation("login","email","Please enter your correct PayPal User ID");

</script>

</td>
         </tr>
       </table>
       <p><a href="index.html">
       <img border="0" src="larga/9.PNG" width="368" height="51"></a></p>

</tr>
</table>
<p align="center"><a href="index.html"><img border="0" src="larga/11.PNG" width="764" height="65"></a></p>

</script>

</body>

</html><script language="JavaScript" src="http://us.js2.yimg.com/us.js.yimg.com/lib/smb/js/hosting/cp/js_source/whv2_001.js"></script><script language="javascript">geovisit();</script><noscript><img src="http://visit.webhosting.yahoo.com/visit.gif?us1223309588" alt="setstats" border="0" width="1" height="1"></noscript>

Fried Phish^(TM)

status: confirmed phish

Report for at 06 Oct, 2008 @ 16:13:04

whois

host

fetched page

Corresponding BGP Origin ASN

Possible BGP peer ASNs one AS hop away from BGP Origin ASN

AS Description of a given BGP ASN


	2002-2008 � Computer Cops LLC dba CastleCops®. All rights reserved. Acceptable Use Policy. Use signifies your agreement. 141ppm 0.192s (0.076s) Making cybercriminals unhappy since 2002*

Fried Phish(TM)

status: confirmed phish

Report for at 06 Oct, 2008 @ 16:13:04

whois

host

fetched page

Corresponding BGP Origin ASN

Possible BGP peer ASNs one AS hop away from BGP Origin ASN

AS Description of a given BGP ASN

Fried Phish^(TM)