Are scammers leaving subtle clues?

Today we saw the following Google AdWords phishing scam in our spam traps:


A legitimate link is displayed in the mail body as However, as with most phishing emails this isn’t the link which is accessed when clicked.

The clue is in the registration information for the web site which is accessed. This site is registered to an address in Shady Lane.