For paypal and ebay. (same company I know)
I have personally been responsible for (in the past week) 18 of those sites being shut down. They are using google to redirect(though "I'm feeling lucky" features, nice eh?), or are only using the IP Address and a spoofing url (http://333.444.555.666/cgi.ebay.com/flarphenungen/run/login.cgi.dll) or something similar.
BTW, to make *Z's* HTML filters ignore things... just backslash the first forwardslash of the URL (http:\\//blah)