Hallo
If you modify the code in bid 17404 in such a way:
win = window.open('http://server/prova.zip','new')
pause (2000)
the user will see the page opening of correct site, and then download alert
from original file site (server)
Obviusly the alert form show the real, but if no dns resolution is provided i
think that the middle user should try to download the file trusting web browser
page.
This is just a gonzo pishing but probably usable in the wild.
regards