The file at this URL...
http://0xd1130a9c/eBayISAPI.dll
...opens just fine as a fake eBay login page in Internet Explorer, but triggers a file download in Firefox.
It's not just because of the .dll suffix. EBayISAPI.dll actually is the name of the eBay login page. You normally see it followed by a question mark and then miles of login cruft, without which it redirects to a you-screwed-up page. I don't know exactly how this copy of it is broken, but it clearly is, in Firefox at least.
(The obfuscated URL is, by the way, actually http://209.19.10.156/eBayISAPI.dll. I've received many copies of this phish, though, and they probably use lots of different servers; it's just that I've only now bothered to look at one in more detail.)
I suppose it's possible that the broken Firefox behaviour is by design, to constrain this phish's audience to the drooling masses in the IE world. The integrated Google Safe Browsing phish indicator in Firefox 2 works fine with this URL, but you have to manually cut the URL out of the phish e-mail and paste it into the Safe Browsing submit box if you want to submit it. Enough people have bothered to do that that that site does indeed have the ominous darkened look that Firefox gives suspected fakes, if you manage to trick it into loading. But Firefox users normally never get to see it - they just go straight to the confusing (and, at least, harmless), download box.
If you're using a browser that's quirk-friendly enough that it recognises that this file is renderable HTML (it's the usual code cut-and-pasted from eBay's real login page, with strategic edits), you get the fake login form, which submits (in this case at least) to http://members.lycos.co.uk/ineedmoney2/dukyy.php. That, at the moment, seems to redirect to another, already-shut-down, phish page.
You'd really think that ISPs would have some basic search bots scanning their hosted sites for pages called eBayISAPI-dot-anything, or titled "Sign In" or "BankName Internet Banking". There really can't be that many of those pages, and it'd be simplicity itself to set up an arrangement that lets a human scan through fifty of them a minute, see which ones look like phish pages, and disable the accounts that're hosting said pages.
(I dare say quite a few phishes are hosted on actual discrete privately owned servers sitting in the corner of a business office. But most of them are on servers that can be cut off by a hosting company.)
Perhaps some hosts are doing that already, but it's clear that most aren't. Because, of course, it'd cost money. Most phish pages are hosted on unsuspecting servers whose administrators left security holes open, and nobody wants their hosting cut off just because some miscreant happened to host a fake Amazon login page on their server for a while. That's the kind of thing that might cause the hosts to lose customers.
So, instead, we get the current situation, where the phish pages get to hang around for at least a day or two as the ISPs receive complaints and/or notice their IPs on phish lists, then tell the unwitting phish-hosting customer, then go back and forth for a while figuring out who has to fix the problem and how.
In the meantime, people get robbed.
As Bruce Schneier's pointed out so many times (talking about software, but hosting companies are in the software business too), the way to make businesses implement security is to force them to do it, financially. If they're not liable, if it doesn't cost more to be insecure than it costs to be secure, they'll stay insecure, no matter how many other people's lives are ruined by their unconcern.
You wouldn't get far by suing HostyPlace for the security misdeeds of its clients. But if you started suing the clients, they'd probably share the joy.