5.1.9 Link Text in Email Differs From Link Destination
In fraudulent email, the link that was present in the email is usually different than the actual destination. For example, the email looks as though it is going to send the user to “http://account-registration.com,” but instead sends the user to
“http://www.membership.com.”
http://account.earthlink.com