Tricky...

I couldn't figure it out.

I got the Citibank spam (the one that asks you to enter your ATM card number and PIN so that Citibank can verify your email address), but the listed URL appeared to be a Citibank URL:

Dear Citibank Member,


This email was sent by the Citibank server to verify your E-mail
address. You must complete this process by clicking on the link
below and entering in the small window your Citibank ATM/Debit
Card number and PIN that you use on ATM.


This is done for your protection - because some of our members
no longer have access to their email addresses and we must
verify it.


To verify your E-mail address and access your bank account,
click on the link below:

https://web.da-us.citibank.com/signin/citifi/scripts/email_verify.jsp


---------------------------------------

Thank you for using Citibank

---------------------------------------

Then I viewed the source of the email message, and found this interesting little item in the source code (tag identifiers have been changed for display purposes):

To verify your E-mail address and access your bank account,{BR}
click on the link below:{/P}
{A href="http://www.infouserupdate.us/scripts/email_verify.htm"}
https://web.da-us.citibank.com/signin/citifi/scripts/email_verify.jsp{/A}{/A}

Things are not always as they seem...