One of the more complex phising of PayPal I have seen

[Noam Rathaus <noamr () beyondsecurity com>]

After you have seen this page:
http://www.google.pt/url?sa=U&start=4&q=http://dns1.n-kiso.co.jp/.checking/.www.paypal.com/index.php

Click on the "moved" request, and see how it constructs a web site that 
appears according to your used web browser (IE vs Firefox).

-- 

Noam Rathaus
CTO
Beyond Security

http://www.beyondsecurity.com
http://www.securiteam.com
_______________________________________________
Fun and Misc security discussion for OT posts.
https://linuxbox.org/cgi-bin/mailman/listinfo/funsec
Note: funsec is a public and open mailing list.