The credentials submission form for #52944 is part of the email, and is supposed to be POSTed to "http://www.infohouse.jp/vbv/run.php"
A comment in the email says that the phish was copied from "http://leonidasvancouver.com/admin/plm/plm.html", though that link is currently dead. -- AT&T Uverse; Zyxel NBG334W router (behind the 2wire gateway); openSuSE 12.1; firefox 9.0.1
·