CastleCops® Bank of Tuscaloosa, Keesler FCU Phish

fetched page

at 13 May, 2008 @ 18:24:22
MD5 Fingerprint: a04738fa378308597315419907cc8c16
SHA1 Fingerprint: 6da5cf6e52197c64c5a8484a4a82279506798495

HTTP/1.1 200 OK
Date: Tue, 13 May 2008 17:49:51 GMT
Server: Apache/2.0.40 (Red Hat Linux)
Last-Modified: Mon, 05 May 2008 11:18:16 GMT
ETag: "1e002a-29b5-e35b2e00"
Accept-Ranges: bytes
Content-Length: 10677
Content-Type: text/html; charset=ISO-8859-1

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head><title>Bank of Tuscaloosa | Token FAQs</title>

<div id="container">
			<div id="page">
				<div id="banner">
					<div id="banner-brand">
						<a href="http://www.bankoftuscaloosa.com/"><img id="banner-logo" src="index.cfm_files/logo.gif" alt="Bank of Tuscaloosa" title="Bank of Tuscaloosa"></a>
						
					</div>
					<div id="banner-print">
						<img src="index.cfm_files/print-logo.gif" alt="Bank of Tuscaloosa" title="Bank of Tuscaloosa">
					</div>
					<div id="banner-tools">
						<ul>
							
								<li><a href="http://www.bankoftuscaloosa.com/index.cfm">Home</a></li>
								
									
											<li><a href="https://www.businessonlineaccess.web-cashplus.com/Cashplus/">Business OnLine Access</a></li>
										
								
								
								
								
								
								
								
								<li><a href="http://www.bankoftuscaloosa.com/index.cfm?id=1093">Switch Kits</a></li>
								<li><a href="http://www.bankoftuscaloosa.com/index.cfm?id=4">Locations</a></li>
							
							<li><a href="javascript:openPageContact();">Contact Us</a></li>
						</ul>
						<form name="search-form" id="search-form" action="index.cfm?id=search" method="post">
							<input onfocus="this.select()" name="searchData" size="28" maxlength="80" value="Enter Search Here" style="font-size: 12px;" type="text">
							<input style="padding-right: 5px;" name="submit" src="index.cfm_files/search-go.gif" alt="Go" type="image">
						</form>
					</div>
					
					
					
					
					
					
					
					<div id="banner-mainnav">
						<div id="banner-navbar">
							
									<a href="http://www.bankoftuscaloosa.com/index.cfm?id=1064" onmouseover="move_in('mainNav1','/includes/images/nav-about-2.gif')" onmouseout="move_out('mainNav1','/includes/images/nav-about-1.gif')"><img name="mainNav1" src="index.cfm_files/nav-about-1.gif" alt="About Us" title="About Us" height="24" width="111"></a>
									<a href="http://www.bankoftuscaloosa.com/index.cfm?id=1001" onmouseover="move_in('mainNav2','/includes/images/nav-personal-2.gif')" onmouseout="move_out('mainNav2','/includes/images/nav-personal-1.gif')"><img name="mainNav2" src="index.cfm_files/nav-personal-1.gif" alt="Personal" title="Personal" height="24" width="74"></a>
									<a href="http://www.bankoftuscaloosa.com/index.cfm?id=1042"><img name="mainNav3" src="index.cfm_files/nav-smallbiz-3.gif" alt="Small Business" title="Small Business" height="24" width="112"></a>
									<a href="http://www.bankoftuscaloosa.com/index.cfm?id=1062" onmouseover="move_in('mainNav4','/includes/images/nav-comminst-2.gif')" onmouseout="move_out('mainNav4','/includes/images/nav-comminst-1.gif')"><img name="mainNav4" src="index.cfm_files/nav-comminst-1.gif" alt="Commercial &amp; Institutional" title="Commercial &amp; Institutional" height="24" width="164"></a>
								
						</div>
					</div>
					<div id="banner-mainbar"></div>
				</div>
				<div id="content">
					<div id="navcontainer">
						<div id="navcontainer-nav">
							
								
		
			<ul id="navlist1">
				
					
					
					<li><a href="http://www.bankoftuscaloosa.com/index.cfm?id=274">Trade Credit Express</a>
					
					
					</li>
				
					
					
					<li><a href="http://www.bankoftuscaloosa.com/index.cfm?id=93">Deposit and Cash Flow</a>
					
					
						
						
					
					</li>
				
					
					
					<li><a href="http://www.bankoftuscaloosa.com/index.cfm?id=94">Business OnLine Access</a>
					
					
					</li>
				
					
					
					<li><a href="http://www.bankoftuscaloosa.com/index.cfm?id=99">Savings Services</a>
					
					
						
						
					
					</li>
				
					
					
					<li><a href="http://www.bankoftuscaloosa.com/index.cfm?id=105">Credit Services</a>
					
					
						
						
					
					</li>
				
					
					
					<li><a href="http://www.bankoftuscaloosa.com/index.cfm?id=175">Payment Solutions</a>
					
					
						
						
					
					</li>
				
					
					
					<li><a href="http://www.bankoftuscaloosa.com/index.cfm?id=38">Commercial Leasing</a>
					
					
					</li>
				
					
					
					<li><a href="http://www.bankoftuscaloosa.com/index.cfm?id=121">Asset Management</a>
					
					
						
						
					
					</li>
				
					
					
					<li><a href="http://www.bankoftuscaloosa.com/index.cfm?id=113">Risk Management</a>
					
					
						
						
					
					</li>
				
			</ul>

</div>

<tbody><br><tr>
								<td style="padding: 0pt 15px 15px;"><p><h3>Online Banking Secure Login</h3>

</tr>
													
			<TD align=left style="font-family: arial,helvetica,sans-serif; font-size: 10pt; color:#000000; font-weight:normal; border-bottom-style:solid; border-bottom-width:1px; border-left-style:none; border-left-width:medium; border-right-style:none; border-right-width:medium; border-top-style:none; border-top-width:medium" width="215">

<font face="Arial" style="font-size: 10pt; font-family:arial,helvetica,sans-serif" color="#003366">
            Password</font></TD>
          <TD style="border-style:none; border-width:medium; font-family: arial,helvetica,sans-serif; font-size: 10pt; color:#000000; font-weight:normal; " width="435">
			<font face="Arial" style="font-family: arial,helvetica,sans-serif; font-size: 10pt; color:#000000">

<div id="footer">
					<div id="footer-utility">
						<a href="http://www.bankoftuscaloosa.com/index.cfm">Home</a> | 
						<a href="http://www.bankoftuscaloosa.com/index.cfm?id=4">Locations</a> | 
						<a href="javascript:openPageContact();">Contact Us</a> | 
						<a href="http://www.bankoftuscaloosa.com/index.cfm?id=1">Privacy</a> | 
						<a href="http://www.bankoftuscaloosa.com/index.cfm?id=2">Internet Privacy</a> | 
						<a href="http://www.bankoftuscaloosa.com/index.cfm?id=12">Safety &amp; Security</a> | 
						
							<a href="http://www.bankoftuscaloosa.com/index.cfm?id=5">Meet Synovus</a> | 
						
						<a href="http://www.bankoftuscaloosa.com/index.cfm?id=49">Site Map</a>
					</div>
					<div id="footer-copyright">
						Copyright ©2007 Bank of Tuscaloosa. Member FDIC. All rights reserved. <span id="footer-terms">See <a href="http://www.bankoftuscaloosa.com/index.cfm?id=3">Terms and Conditions</a></span>.
					</div>
				</div>
			</div>
		</div>

</body>

</html>

fetched page

at 15 May, 2008 @ 00:19:02
MD5 Fingerprint: 48880fcc75ce3dbba0271406e75b14f4
SHA1 Fingerprint: da2b48c7ea2b721f91175fd125eab1c03d878c55

fetched page

at 15 May, 2008 @ 00:21:53
MD5 Fingerprint: d41d8cd98f00b204e9800998ecf8427e
SHA1 Fingerprint: da39a3ee5e6b4b0d3255bfef95601890afd80709

fetched page

at 15 May, 2008 @ 00:24:17
MD5 Fingerprint: d41d8cd98f00b204e9800998ecf8427e
SHA1 Fingerprint: da39a3ee5e6b4b0d3255bfef95601890afd80709

HTTP/1.1 302 Found
Date: Wed, 14 May 2008 23:32:36 GMT
Server: Apache/2.0.40 (Red Hat Linux)
Accept-Ranges: bytes
X-Powered-By: PHP/4.2.2
Location: mcw001.cgi.htm
Content-Length: 0
Content-Type: text/html; charset=ISO-8859-1

HTTP/1.1 200 OK
Date: Wed, 14 May 2008 23:32:38 GMT
Server: Apache/2.0.40 (Red Hat Linux)
Last-Modified: Sun, 11 May 2008 08:18:24 GMT
ETag: "44038-3612-13269400"
Accept-Ranges: bytes
Content-Length: 13842
Content-Type: text/html; charset=ISO-8859-1

<html><head><title>Keesler Federal Credit Union Home Banking 2</title>

a { text-decoration:none; }

a:hover {color: #4169E1;}

body,table,tr,td { font-family: Arial, sans-serif; font-size: 11pt; }

h2 {color: #CA5; font: bold 24px Verdana,Arial, sans-serif; margin-top: 0; margin-bottom: 5; }

</style>

function userfocus(){

var MyURL=window.location.href;

var x = document.getElementById("FORM1");

if (x != null &&

MyURL=="https://www.kfcu.org/cgi-bin/mcw000.cgi?MCWSTART" ||

MyURL=="https://www.kfcu.org/cgi-bin/mcw005.cgi?MCWSTART" ||

MyURL=="https://www/cgi-bin/mcw000.cgi?MCWSTART" ||

MyURL=="https://www/cgi-bin/mcw005.cgi?MCWSTART" ||

MyURL=="https://www2/cgi-bin/mcw000.cgi?MCWSTART" ||

MyURL=="https://www2/cgi-bin/mcw005.cgi?MCWSTART" ||

MyURL=="https://www3/cgi-bin/mcw000.cgi?MCWSTART" ||

MyURL=="https://www3/cgi-bin/mcw005.cgi?MCWSTART"){

if (x != null && x.elements[3].name == "HBUSERNAME"){

x.elements[3].focus();

}

else if (x != null &&

MyURL=="https://www.kfcu.org/cgi-bin/mcw000.cgi?MCWSTARTUSERNAMEREG" ||

MyURL=="https://www.kfcu.org/cgi-bin/mcw005.cgi?MCWSTARTUSERNAMEREG" ||

MyURL=="https://www/cgi-bin/mcw000.cgi?MCWSTARTUSERNAMEREG" ||

MyURL=="https://www/cgi-bin/mcw005.cgi?MCWSTARTUSERNAMEREG" ||

MyURL=="https://www2/cgi-bin/mcw000.cgi?MCWSTARTUSERNAMEREG" ||

MyURL=="https://www2/cgi-bin/mcw005.cgi?MCWSTARTUSERNAMEREG" ||

MyURL=="https://www3/cgi-bin/mcw000.cgi?MCWSTARTUSERNAMEREG" ||

MyURL=="https://www3/cgi-bin/mcw005.cgi?MCWSTARTUSERNAMEREG"){

if (x != null && x.elements[3].name == "ACCOUNTNUMBER"){

x.elements[3].focus();

}

else if (x != null &&

MyURL=="https://www.kfcu.org/cgi-bin/mcw000.cgi" ||

MyURL=="https://www.kfcu.org/cgi-bin/mcw005.cgi" ||

MyURL=="https://www/cgi-bin/mcw000.cgi" ||

MyURL=="https://www/cgi-bin/mcw005.cgi" ||

MyURL=="https://www2/cgi-bin/mcw000.cgi" ||

MyURL=="https://www2/cgi-bin/mcw005.cgi" ||

MyURL=="https://www3/cgi-bin/mcw000.cgi" ||

MyURL=="https://www3/cgi-bin/mcw005.cgi"){

if (x != null && x.elements[5].name == "HBUSERNAME"){

x.elements[5].focus();

}

else if (x != null && x.elements[1].name == "HBUSERNAME"){

x.elements[1].focus();

}

x = null;

}

</script>

<!--

var FlashSupported=0;

if (navigator.userAgent.indexOf("Mac")==-1)

{

document.write('<SCRIPT LANGUAGE="VBScript"\> \n');

document.write('on error resume next  \n');

document.write('FlashSupported = IsObject(CreateObject("ShockwaveFlash.ShockwaveFlash.3")) \n');

var TempVar1="</S";

TempVar1+="CRIPT\> \n";

document.write(TempVar1);

}

if (navigator.mimeTypes &&

navigator.mimeTypes["application/x-shockwave-flash"] &&

navigator.mimeTypes["application/x-shockwave-flash"].enabledPlugin)

{

if (navigator.plugins && navigator.plugins["Shockwave Flash"])

FlashSupported=1;

}

function ShowRandomBannerAd()

{

var BannerCount=2;

<!-- Change BannCount to -1 to turn banners off --!>

var RandomNumber=Math.floor(Math.random()*BannerCount)+1;

if (RandomNumber==1)

{

ShowBannerAd('banner1.swf','banner1.gif',475,60,'https://www.kfcu.org/products.services/loans/auto.html');

}

else if (RandomNumber==2)

{

ShowBannerAd('banner2.swf','',475,60,'https://www.kfcu.org/products.services/loans/motorcycle.html');

}

else if (RandomNumber==3)

{

ShowBannerAd('banner1.swf','banner1.gif',475,60,'https://www.kfcu.org/products.services/loans/credit.html');

}

function ShowBannerAd(MovieName,ImageName,AdWidth,AdHeight,DestURL)

{

if (FlashSupported && MovieName!='')

{

document.writeln('<TABLE CELLPADDING=0 CELLSPACING=0 BORDER=0><TR VALIGN=BOTTOM><TD>');

document.writeln('<OBJECT CLASSID="clsid:D27CDB6E-AE6D-11cf-96B8-444553540000"');

document.writeln(' CODEBASE="https://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab#3,0,0,0"');

document.writeln(' WIDTH='+AdWidth+' HEIGHT='+AdHeight+' ALIGN=TOP>');

document.writeln(' <PARAM NAME="SRC" VALUE="/ns-icons/'+MovieName+'">');

document.writeln(' <PARAM NAME="QUALITY" VALUE="high">');

document.writeln(' <PARAM NAME="LOOP" VALUE="true">');

document.writeln(' <EMBED SRC="/ns-icons/'+MovieName+'" PLUGINSPAGE="https://www.macromedia.com/shockwave/download/"');

document.writeln(' TYPE="application/x-shockwave-flash" WIDTH='+AdWidth+' HEIGHT='+AdHeight+' QUALITY="high"');

document.writeln(' ALIGN="TOP" LOOP="true" VSPACE=0>');

document.writeln(' </EMBED>');

document.writeln('</OBJECT>');

if (DestURL!='')

{

document.writeln('</TD><TD><A HREF="'+DestURL+'" target="view_window"><IMG SRC="/ns-icons/clickhereBLUE.gif"');

document.writeln(' WIDTH=52 HEIGHT=52 BORDER=0 HSPACE=8 VSPACE=2></A>');

}

document.writeln('</TD></TR></TABLE>');

}

else if (!(navigator.appName &&

navigator.appName.indexOf("Netscape")>=0 &&

navigator.appVersion.indexOf("2.")>=0) &&

ImageName!='')

{

if (DestURL!='')

{

document.write('<A HREF="'+DestURL+'">');

}

document.write('<IMG SRC="/ns-icons/'+ImageName+'" WIDTH='+AdWidth+' HEIGHT='+AdHeight+' BORDER=0>');

if (DestURL!='')

{

document.write('</A>');

}

//-->

</script><script language="VBScript"> 
on error resume next  
FlashSupported = IsObject(CreateObject("ShockwaveFlash.ShockwaveFlash.3")) 
</script>

<!-- OR JUST USE THE FOLLOWING TEXT...

Credit Union

</FONT><BR> -->

</td>

<!--

ShowRandomBannerAd();

//-->

</script><table border="0" cellpadding="0" cellspacing="0"><tbody><tr valign="bottom"><td>
<object classid="clsid:D27CDB6E-AE6D-11cf-96B8-444553540000" codebase="https://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab#3,0,0,0" align="top" height="60" width="475">
 <param name="SRC" value="/ns-icons/banner1.swf">
 <param name="QUALITY" value="high">
 <param name="LOOP" value="true">
 <embed src="mcw001.cgi_files/banner1.txt" pluginspage="https://www.macromedia.com/shockwave/download/" type="application/x-shockwave-flash" quality="high" loop="true" align="top" height="60" vspace="0" width="475">
 
</object>
</td><td><a href="https://www.kfcu.org/products.services/loans/auto.html" target="view_window"><img src="mcw001.cgi_files/clickhereBLUE.gif" border="0" height="52" hspace="8" vspace="2" width="52"></a>
</td></tr></tbody></table>

</td>

</tr>

</tr>

<tr>

&nbsp;<br>

<font size="2">Welcome to</font><br>

CU@Home

</font><br><br>

<br>

</a></td>

<td>

if (document.FORM1 != null)

{

}

if (window.document.forms[0]){

document.forms[0].focus()

}

function SubmitInfo1()

{

document.FORM1.HBUSERNAME.focus();

document.FORM1.HBUSERNAME.value="signup00";

document.FORM1.PASSWORD.value="12345678";

document.FORM1.submit();

}

var MyURL=window.location.href

if (window.document.forms[0] != null &&

MyURL=="https://www.kfcu.org/cgi-bin/mcw000.cgi?MCWSTART" ||

MyURL=="https://www.kfcu.org/cgi-bin/mcw005.cgi?MCWSTART" ||

MyURL=="https://www/cgi-bin/mcw000.cgi?MCWSTART" ||

MyURL=="https://www/cgi-bin/mcw005.cgi?MCWSTART" ||

MyURL=="https://172.16.0.20/cgi-bin/mcw000.cgi?MCWSTART" ||

MyURL=="https://172.16.0.20/cgi-bin/mcw005.cgi?MCWSTART" ||

MyURL=="https://208.62.98.194/cgi-bin/mcw000.cgi?MCWSTART" ||

MyURL=="https://208.62.98.194/cgi-bin/mcw005.cgi?MCWSTART" ||

MyURL=="https://www2/cgi-bin/mcw000.cgi?MCWSTART" ||

MyURL=="https://www2/cgi-bin/mcw005.cgi?MCWSTART" ||

MyURL=="https://172.16.200.3/cgi-bin/mcw000.cgi?MCWSTART" ||

MyURL=="https://172.16.200.3/cgi-bin/mcw005.cgi?MCWSTART" ||

MyURL=="https://208.72.129.100/cgi-bin/mcw000.cgi?MCWSTART" ||

MyURL=="https://208.72.129.100/cgi-bin/mcw005.cgi?MCWSTART" ||

MyURL=="https://www3/cgi-bin/mcw000.cgi?MCWSTART" ||

MyURL=="https://www3/cgi-bin/mcw005.cgi?MCWSTART" ||

MyURL=="https://172.16.0.22/cgi-bin/mcw000.cgi?MCWSTART" ||

MyURL=="https://172.16.0.22/cgi-bin/mcw005.cgi?MCWSTART")

{

document.write("<div align='center'><br><form name='signup' id='signup' method='post'>")

document.write("<input type='button' onclick='SubmitInfo1()' value='CU@Home Sign-up'>&nbsp;&nbsp;&nbsp;")

document.write("<input type='button' onclick='SubmitInfo1()' value='Password Reset'>")

document.write("</form><br></div>")

}

</script>

</font></p><div style="border: 1px solid black; padding: 5px; display: none; width: 475px; font-family: arial;">

<font face="ARIAL,HELVETICA" size="3">eStatements / eChecks Maintenance

</font></span>

</center>

<font face="ARIAL,HELVETICA" size="3">Monday, May 5<sup>th</sup>, 2008 - eStatements and eChecks are

undergoing system maintenance.  Some members may find these

services temporarily unavailable. We apologize for any

inconvenience.</font></span>

</div>

</font></td>

</tr>

</tbody></table>

var gaJsHost = (("https:" == document.location.protocol) ? "https://ssl." : "http://www.");

document.write(unescape("%3Cscript src='" + gaJsHost + "google-analytics.com/ga.js' type='text/javascript'%3E%3C/script%3E"));

</script><script src="mcw001.cgi_files/ga.js" type="text/javascript"></script>

var pageTracker = _gat._getTracker("UA-2348846-1");

pageTracker._initData();

pageTracker._trackPageview();

</script>

document.write("")

</script>

</td></tr></tbody></table></body></html>

Fried Phish^(TM)

status: terminated

Report for at 13 May, 2008 @ 18:24:19

whois

host

fetched page

fetched page

fetched page

fetched page

Corresponding BGP Origin ASN

Possible BGP peer ASNs one AS hop away from BGP Origin ASN

AS Description of a given BGP ASN


	2002-2008 � Computer Cops LLC dba CastleCops®. All rights reserved. Acceptable Use Policy. Use signifies your agreement. 79ppm 0.422s (0.199s) Making cybercriminals unhappy since 2002*

Fried Phish(TM)

status: terminated

Report for at 13 May, 2008 @ 18:24:19

whois

host

fetched page

fetched page

fetched page

fetched page

Corresponding BGP Origin ASN

Possible BGP peer ASNs one AS hop away from BGP Origin ASN

AS Description of a given BGP ASN

Fried Phish^(TM)