Sadly I do not have access to the tools to give me packet captures :-(. I don't even think those that do have the access actually are capturing packets. I did send an email to the webmaster of the supposed valid site but did not get a response. The traffic to the site has since stopped, I imagine the powers-that-be put the IP and site in the RBL. I'm sure there will be more systems like this in the future.