Phish Alert
 
 Full Report: /PayPal_Susquehanna_phish897078.html
 
 Consumed following related reports:

[893474] http://www.gopiter.com/extreme/pics/new.php
[895967] http://www.gopiter.com/flash/a/new.php
The URL redirects to a PayPal phishing site at http://e-veyhlp.net/verify/paypal.com/webscr.html?cmd=_login-run
, active at the time of investigation.
Both sites need to be shut down.
A page fetch was successful.
A redirect at
http://www.gopiter.com/extreme/pics/new.php
has target PayPal phish
http://oxea-web.fr/wear/tmp/paypal.com/webscr.html?cmd=_login-run
A redirect at
http://www.gopiter.com/flash/a/new.php
has target Susquehanna phish
http://e-veyhlp.net/onlinehelp/susquehanna.net/Authentication/Login.htmlChanged status to confirmed phish.IP Converted: 80.93.56.169

dword = 1348286633
hex1 = 0x505d38a9
hex2 = 0x50.0x5d.0x38.0xa9
oct = 0120.0135.070.0251
View CIDR AS35569 Report: http://www.cidr-report.org/cgi-bin/as-report?as=35569

"35569 | RU | ripencc | 2005-09-06 | PETERHOST-MOSCOW PeterHost.Ru Hosting Provider at Moscow"<br />
Extended information for AS35569:
State/Province:
Country: ru
Responsible Domain: peterhost.ru
Abuse Email: phil@peterhost.ru
IP Converted: 84.246.225.183

dword = 1425465783
hex1 = 0x54f6e1b7
hex2 = 0x54.0xf6.0xe1.0xb7
oct = 0124.0366.0341.0267
View CIDR AS34274 Report: http://www.cidr-report.org/cgi-bin/as-report?as=34274

"34274 | FR | ripencc | 2004-12-06 | ELBMULTIMEDIA Hosting de ELB MULTIMEDIA"<br />
Extended information for AS34274:
State/Province:
Country: fr
Responsible Domain: elb.fr
Abuse Email:
http://e-veyhlp.net/verify/paypal.com/webscr.html?cmd=_login-run
changed to
http://e-veyhlp.net/account/paypal.com/webscr.html?cmd=_login-runPayPal phish on e-veyhlp.net
moved to
http://e-veyhlp.net/accounts/paypal.com/webscr.html?cmd=_login-runGenerated and sent email phish alert to respective parties.