[Watford] Puzzling Phishing Email

[Jim Ford]

Hi.

I had an email today, purportedly from PayPal, that appears to me to be
clearly phishing.

I clicked on the link provided, which took me to a 'PayPal' site -
except that it seemed to me to be a phishing site.

I reported the link to 'Netcraft', in order that other users are alerted.

Netcraft came back to me, stating that it wasn't a phishing site.

On checking the link again, instead of going to the original site, I was
taken to a Google search for paypal.co.uk

Is it possible that the original link changed after first clicking it?

This is the site I was taken to by the original link, retrieved via my
browser's history:

http://jaford.67231.userpageppl.com/?q=login&e=amFmb3JkQHdhdGZvcmQ1My5mcmVlc2VydmUuY28udWs=

The email link is now:

http://h24xgctx1qr0y.jjkq2.com/uk/?amFmb3JkQHdhdGZvcmQ1My5mcmVlc2VydmUuY28udWs=

which takes me to:

https://www.google.com/search?q=paypal.co.uk

I'm baffled!

Jim