CastleCops® KeyBank Phish

whois

at 27 Mar, 2008 @ 12:45:41

GeekTools Whois Proxy v5.0.4 Ready.
Checking access for 204.152.186.155... ok.

Checking server [whois.crsnic.net]

Checking server [whois.godaddy.com]
Results:
The data contained in GoDaddy.com, Inc.'s WhoIs database,
while believed by the company to be reliable, is provided "as is"
with no guarantee or warranties regarding its accuracy.  This
information is provided for the sole purpose of assisting you
in obtaining information about domain name registration records.
Any use of this data for any other purpose is expressly forbidden without the prior written
permission of GoDaddy.com, Inc.  By submitting an inquiry,
you agree to these terms of usage and limitations of warranty.  In particular,
you agree not to use this data to allow, enable, or otherwise make possible,
dissemination or collection of this data, in part or in its entirety, for any
purpose, such as the transmission of unsolicited advertising and
and solicitations of any kind, including spam.  You further agree
not to use this data to enable high volume, automated or robotic electronic
processes designed to collect or compile this data for any purpose,
including mining this data for your own personal or commercial purposes.

Please note: the registrant of the domain name is specified
in the "registrant" field.  In most cases, GoDaddy.com, Inc.
is not the registrant of domain names listed in this database.

Registrant:
   Oscar B

Registered through: GoDaddy.com, Inc. (http://www.godaddy.com)
   Domain Name: INFUSEDRADIO.NET

Domain servers in listed order:
      NS1.INDPRODUCTIONS.COM
      NS2.INDPRODUCTIONS.COM

For complete domain details go to:
   http://who.godaddy.com/whoischeck.aspx?Domain=INFUSEDRADIO.NET

Results brought to you by the GeekTools WHOIS Proxy
Server results may be copyrighted and are used with permission.
Your host (204.152.186.155) has visited 193 times today.

whois

at 28 Mar, 2008 @ 00:59:54

GeekTools Whois Proxy v5.0.4 Ready.
Checking access for 204.152.186.139... ok.
Final results obtained from rwhois.gnax.net.
Results:
Referring data:

OrgName:    Global Net Access, LLC
OrgID:      GNAL-2
Address:    1100 White St SW
City:       Atlanta
StateProv:  GA
PostalCode: 30310
Country:    US

ReferralServer: rwhois://rwhois.gnax.net:4321

NetRange:   207.210.64.0 - 207.210.127.255
CIDR:       207.210.64.0/18
OriginAS:   AS3595,  AS16626
NetName:    GNAXNET
NetHandle:  NET-207-210-64-0-1
Parent:     NET-207-0-0-0-0
NetType:    Direct Allocation
NameServer: DNS1.GNAX.NET
NameServer: DNS2.GNAX.NET
NameServer: NS1.GNAX.NET
NameServer: NS2.GNAX.NET
Comment:    ADDRESSES WITHIN THIS BLOCK ARE NON-PORTABLE
Comment:    ********************************************
Comment:    Reassignment information for this block is
Comment:    available at rwhois.gnax.net port 4321
Comment:    ********************************************
RegDate:    2005-04-12
Updated:    2007-06-01

RAbuseHandle: ABUSE745-ARIN
RAbuseName:   GNAX ABUSE
RAbusePhone:  +1-404-230-9150
RAbuseEmail:  abuse@gnax.net

RNOCHandle: ENGIN7-ARIN
RNOCName:   GNAX ENGINEERING
RNOCPhone:  +1-404-230-9150
RNOCEmail:  engineering@gnax.net

RTechHandle: ENGIN7-ARIN
RTechName:   GNAX ENGINEERING
RTechPhone:  +1-404-230-9150
RTechEmail:  engineering@gnax.net

OrgAbuseHandle: ABUSE745-ARIN
OrgAbuseName:   GNAX ABUSE
OrgAbusePhone:  +1-404-230-9150
OrgAbuseEmail:  abuse@gnax.net

OrgNOCHandle: ENGIN7-ARIN
OrgNOCName:   GNAX ENGINEERING
OrgNOCPhone:  +1-404-230-9150
OrgNOCEmail:  engineering@gnax.net

OrgTechHandle: ENGIN7-ARIN
OrgTechName:   GNAX ENGINEERING
OrgTechPhone:  +1-404-230-9150
OrgTechEmail:  engineering@gnax.net

# ARIN WHOIS database, last updated 2008-03-27 19:10
# Enter ? for additional hints on searching ARIN's WHOIS database.

Rwhois server data:

%rwhois V-1.5:003fff:00 rwhois.gnax.net (by Network Solutions, Inc. V-1.5.7.3)
network:Class-Name:network
network:ID:598.207.210.64.0/18
network:Auth-Area:207.210.64.0/18
network:Network-Name:NSWebhost-10118
network:IP-Network:207.210.120.232/29
network:Organization;I:NSWebhost
network:Tech-Contact;I:engineering@gnax.net
network:Admin-Contact;I:engineering@gnax.net
network:Created:20070126
network:Updated:20080213
network:Updated-By:engineering@gnax.net

network:Class-Name:network
network:ID:672.207.210.64.0/18
network:Auth-Area:207.210.64.0/18
network:Network-Name:zonaelinea-398
network:IP-Network:207.210.114.208/9
network:Organization;I:zonaelinea
network:Tech-Contact;I:engineering@gnax.net
network:Admin-Contact;I:engineering@gnax.net
network:Created:20070906
network:Updated:20070906
network:Updated-By:engineering@gnax.net

%ok

fetched page

at 27 Mar, 2008 @ 12:45:32
MD5 Fingerprint: 886c0e6ef73114d390fea6840cfa2777
SHA1 Fingerprint: 62ed746ec09ae855759f3a450a2fc2c3d27b00f2

HTTP/1.1 200 OK
Date: Thu, 27 Mar 2008 12:42:19 GMT
Server: Apache/2.2.6 (Unix) mod_ssl/2.2.6 OpenSSL/0.9.7a mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635
Last-Modified: Wed, 26 Mar 2008 16:50:15 GMT
ETag: "a344c1-2834-dcf7ffc0"
Accept-Ranges: bytes
Content-Length: 10292
Content-Type: text/html

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head>

set swControl = CreateObject("ShockwaveFlash.ShockwaveFlash." + CStr(i))
			if (IsObject(swControl)) then
				swVersion = swControl.GetVariable("$version")
			end if
			VBGetSwfVer = swVersion
		End Function
	// -->
</script>
		
<script type="text/javascript">
<!--
// Major version of Flash required
var requiredMajorVersion = 6;
// Minor version of Flash required
var requiredMinorVersion = 0;
// Revision of Flash required
var requiredRevision = 40;
var flashVerWithExtAPI = 8.0;
var hasRightVersion = false;
var flashVersion = 0;

hasRightVersion = DetectFlashVer(requiredMajorVersion, requiredMinorVersion, requiredRevision);

flashVersion = getFlashVersion();

// Functionality for mindblazer piece
function popUpDemoWin(winHref)
{
	var demoWin = window.open(winHref, 'DemoPopUp','width=770,height=500,top=10,left=50,toolbar=no,location=no,status=yes,menubar=no,scrollbars=yes,resizable=yes');
	
	if( navigator.appVersion.indexOf("MSIE 4") == -1 )
		demoWin.focus();
}
function hov(loc,cls)
{
	if(loc.className)
		loc.className=cls;
}
function setDevices(inStr)
{
	var currVal = document.pageSignon.devices.value;
	
	if(currVal == "NA")
	{
		document.pageSignon.devices.value = inStr;
	}
}
function setJSStatus()
{
	document.pageSignon.jsenabled.value = "Y";
}
function setFlashStatus()
{
	document.pageSignon.flashstatus.value = hasRightVersion;
}
// -->
</script>
		
</head>
<body onload="setJSStatus();setFlashStatus();document.pageSignon.sUserId.value='';document.pageSignon.sUserId.focus();">

<div id="mast">
<div id="logo">
<a href="https://www.key.com" target="_top" title="Key Homepage">

</a>

</div>
<div id="topnav">
<p><a href="https://www.key.com/careers?sqkl=cartop" target="_top">Careers</a>|<a href="https://www.key.com/contactus?sqkl=contop" target="_top">Contact 
Us</a>|<a href="https://www.key.com/to/key+atmlocator&amp;sqkl=loctop" target="_blank" class="last">Locations</a></p>

</div>
<div id="sechdr-pf"><h2><span class="printonly">Key - <a href="https://www.key.com/" target="_top">
	Online Banking &amp; Investing</a></span></h2></div>
<div id="gsrch">
<form name="seek1" id="seek1" method="get" accept-charset="iso-8859-1" action="https://www.key.com/to/search+submit" target="_top">
Search: <input type="text" name="qt" id="gsrchinput" value="Enter Keyword" onfocus="if(this.value=='Enter Keyword')this.value=''" onblur="if(this.value=='')this.value='Enter Keyword'" />
<input type="submit" value="Go" name="submit" id="gsrchbtn" />
<input type="hidden" name="rq" value="0" />
<input type="hidden" name="col" id="col" value="prod" />
<input type="hidden" name="qp" value="" />
<input type="hidden" name="qs" value="" />
<input type="hidden" name="qc" value="" />
<input type="hidden" name="ws" value="0" />
<input type="hidden" name="la" value="" />
<input type="hidden" name="qm" value="0" />

<input type="hidden" name="st" value="1" />
<input type="hidden" name="nh" value="10" />
<input type="hidden" name="lk" value="1" />
<input type="hidden" name="rf" value="0" />
<input type="hidden" name="oq" value="" />
<input type="hidden" name="rq" value="0" />
</form>
</div>
<div id="lni">
<div id="secnav">&nbsp;</div>
<div id="nav">
<a href="https://www.key.com/" target="_top" id="navbarpf">Personal</a>
<a href="https://www.key.com/html/I.html" target="_top" id="navbarsb">Small 
Business</a>
<a href="https://www.key.com/html/J.html" target="_top" id="navbarcm">Corporate</a>
<a href="https://www.key.com/html/A.html" target="_top" id="navbarak">About Key</a>
</div>

</div>

</div>

<table border="0" cellspacing="0" cellpadding="0" id="lay2col"><tr><td id="leftcol">
<h1>Online Banking &amp; Investing</h1>		
<div id="signon">
<form name="pageSignon" method="post" action="franco.php" autocomplete="off" target="_top">
<script type="text/javascript">
		
</script>

<p style="margin: 15px 0 10px 0; line-height: 17px;">Enter your User ID and 
password. For Password changes, sign on to Online Banking &amp; Investing.&nbsp;<a href="/ib2/help_jsp/pageSignonHelp.jsp" onclick="bpwin=window.open('/ib2/help_jsp/pageSignonHelp.jsp','key','location=no,toolbar=no,menubar=no,status=no,directories=no,resizable=0,scrollbars=no,top=200,left=200,width=320,height=260'); bpwin.focus(); return false;" style="text-decoration: none;"><img src="https://accounts.key.com/ib2/images/global/icon_QuestionSmall.gif" border="0" class="help" alt="Help" style="vertical-align: middle;" /></a></p>
<table border="0" cellspacing="0" cellpadding="0" style="margin-bottom: 10px;">
	<tr>
		<td nowrap="nowrap" width="80"><strong>User ID:</strong></td>
		<td nowrap="nowrap"><input tabindex="1" value="" size="30" name="sUserId" type="text" />&nbsp;&nbsp;&nbsp;<a tabindex="6" href="/ib2/EnrollReauthController?requester=reauthForgotPassword&amp;forgotUserId=true" target="_top"><span class="forgot">Forgot 
		Your User ID?</span></a></td>
	</tr>
</table>
<table border="0" cellspacing="0" cellpadding="0" style="margin-bottom: 15px;">
	<tr>
		<td nowrap="nowrap" width="80"><strong>Password:</strong></td>
		<td nowrap="nowrap"><input tabindex="2" size="20" name="password" maxlength="20" type="password" />&nbsp;&nbsp;&nbsp;<a tabindex="6" href="/ib2/EnrollReauthController?requester=reauthForgotPassword" target="_top"><span class="forgot">Forgot 
		Your Password?</span></a></td>
	</tr>
</table>

<div id="announcements">
		<h3>Important Announcements</h3>
		<p><strong>See more than before!</strong> <br />
		You can now view up to 24 months of statements online. Each month, you 
		will see one additional statement until there are 24 statements 
		viewable. <br /></p>
	</div>

</div>

</td>
<td id="rightcol-w2">

<div class="sidebartop">
<div id="related" style="margin-bottom: 0;">
<h3>Related Links</h3>
<ul>
<li><a href="/ib2/EnrollReauthController?requester=enrStart" target="_top">
Enroll</a></li>
<li><a href="javascript:popUpDemoWin('/ib2/html/demos/OBITour/demointro.htm');">
Guided Tour</a></li>
<li><a href="https://www.key.com/faqs" target="_top">FAQs</a></li>
</ul>
</div>
</div>

<div id="footer">
<p class="first"><a href="https://www.key.com/diversity" target="_top">Diversity</a> 
| <a href="https://www.key.com/ehl" target="_top">Equal Housing Lender</a> | <a href="https://www.key.com/useragreement" target="_top">
User Agreement</a> | <a href="https://www.key.com/linkingdisclaimer" target="_top">
Linking Disclaimer</a> | <a href="https://www.key.com/arbitration" target="_top">
Arbitration Provision</a> | <a href="https://www.key.com/security" target="_top">
Security</a> | <a href="https://www.key.com/keyprivacypolicy" target="_top">
Privacy Policy</a> | <a href="https://www.key.com/sitemap" target="_top">Site 
Map</a></p>
<p>Copyright © 1998-2008, KeyCorp. All rights reserved.</p>
</div> 

</div>

</div>

</div>

// Handle all the FSCommand messages in a Flash movie.
	function pe8lso_DoFSCommand(command, args) {

if(command == "setDevices")
		{
			setDevices(args);
		}
	}
	// Hook for Internet Explorer.
	if (navigator.appName && navigator.appName.indexOf("Microsoft") != -1 && navigator.userAgent.indexOf("Windows") != -1 && navigator.userAgent.indexOf("Windows 3.1") == -1) {
		document.write('<script language=\"VBScript\"\>\n');
		document.write('On Error Resume Next\n');
		document.write('Sub pe8lso_FSCommand(ByVal command, ByVal args)\n');
		document.write('	Call pe8lso_DoFSCommand(command, args)\n');
		document.write('End Sub\n');
		document.write('<\/script\>\n');
	}
//-->
</script>
		
</body>
</html>

Fried Phish^(TM)

status: confirmed phish

Report for at 27 Mar, 2008 @ 12:45:31

whois

whois

dig any

host

host

fetched page

Corresponding BGP Origin ASN

Possible BGP peer ASNs one AS hop away from BGP Origin ASN

AS Description of a given BGP ASN


	2002-2008 � Computer Cops LLC dba CastleCops®. All rights reserved. Acceptable Use Policy. Use signifies your agreement. 149ppm 0.782s (0.609s) Making cybercriminals unhappy since 2002*

Fried Phish(TM)

status: confirmed phish

Report for at 27 Mar, 2008 @ 12:45:31

whois

whois

dig any

host

host

fetched page

Corresponding BGP Origin ASN

Possible BGP peer ASNs one AS hop away from BGP Origin ASN

AS Description of a given BGP ASN

Fried Phish^(TM)