Depending on your mailer, forwarding a message can mean including the plain-text version of the message.  If a scammer is trying to hide a link destination, they can hide it in the HTML version to look like a different location.  For example, in the HTML version:

<a href="http://myweevil.collector.me">http://www.ccnets.org</a>

Would look like http://www.ccnets.org, but take you to http://myweevil.collector.me.  However, once forwarded by a mailer that only forwards the plain-text body, the link only looks like http://www.ccnets.org.

This loss-of-original can be avoided by forwarding as an attachment (and maybe you did, and listserv included it inline).  Either way, I was attempting to figure out if the link I was following was the same link you were following.

Ben

On Nov 16, 2012, at 12:13 PM, Dawn Pelkey wrote:

> Ben, I forwarded the message that I received, so I'm not sure what you mean by "original link".  Perhaps phish isn't the proper name.  Misleading folks to believe it might be UVM associated would have been a more proper description I guess.
> 
> Dawn
> 
> At 11:30 AM 11/16/2012, you wrote:
>> Ccnets did a similar round of advertising back in July.  Research by Sam Hooker at that time seemed to indicate that the greatest threat was the risk that people would sign up for ccnets using the same Net-ID and password they use for uvm.edu.
>> 
>> If anyone finds evidence of malicious intent with the current campaign, please let this group know.   I may be missing something.
>> 
>> Dean Williams
>> 
>> 
>> [Typed on a tiny keyboard.]
>> 
>> On Nov 16, 2012, at 10:39 AM, Dawn Pelkey <[log in to unmask]> wrote:
>> 
>> > We seem to be popular phishing grounds lately.  This one unfortunately might be harder for users to immediately identify as phish.
>> >
>> > Dawn
>> >
>> >> Return-Path: <[log in to unmask]>
>> >> Received: from imapdir2.uvm.edu (imapdir2.uvm.edu [132.198.100.150])
>> >>        by penguind.uvm.edu (8.14.5/8.14.5) with ESMTP id qAFIqWHj023430
>> >>        for <dpelkey>; Thu, 15 Nov 2012 13:52:32 -0500
>> >> Received: from imapdir2.uvm.edu
>> >>        by imapdir2.uvm.edu (Dovecot) with LMTP id x/WFByg5pVAzVwAAhtAcMw
>> >>        ; Thu, 15 Nov 2012 13:52:32 -0500
>> >> Received: from shelduck.uvm.edu (shelduck.uvm.edu [132.198.101.43])
>> >>        by imapdir2.uvm.edu (8.14.4/8.14.4) with ESMTP id qAFIqW0f026805
>> >>        for <[log in to unmask]>; Thu, 15 Nov 2012 13:52:32 -0500
>> >> Received: from mail.wikinets.net ([72.55.164.202])
>> >>        by shelduck.uvm.edu (8.14.4/8.14.4) with SMTP id qAFIqV3L008661
>> >>        for <[log in to unmask]>; Thu, 15 Nov 2012 13:52:32 -0500
>> >> Received: from WIN-BBE45QGSKMM ([108.61.20.3])
>> >>        by mail.wikinets.net
>> >>        ; Thu, 15 Nov 2012 10:52:29 -0800
>> >> Message-ID: <02a3bc92-41228-dba25783530903@win-bbe45qgskmm>
>> >> From: "Jeff Kitson" <[log in to unmask]>
>> >> To: "UVM" <[log in to unmask]>
>> >> Subject: Join UVM in Collaborative Worlds
>> >> Date: Thu, 15 Nov 2012 13:51:49 -0500
>> >> MIME-Version: 1.0
>> >> Content-Type: text/plain
>> >> Content-Transfer-Encoding: 7bit
>> >> X-Priority: 3
>> >> X-PureMessage-Version: 6.0.0.2142326, Antispam-Engine: 2.7.2.2107409, Antispam-Data: 2012.11.15.184232
>> >> X-PureMessage-Spam: Gauge=XI, Probability=11%, Report='
>> >> PRIORITY_NO_NAME 0.716, HTML_00_01 0.05, HTML_00_10 0.05, BODYTEXTP_SIZE_3000_LESS 0, BODY_SIZE_1000_LESS 0, BODY_SIZE_2000_LESS 0, BODY_SIZE_5000_LESS 0, BODY_SIZE_500_599 0, BODY_SIZE_7000_LESS 0, DATE_TZ_NA 0, INVALID_MSGID_NO_FQDN 0, RDNS_NXDOMAIN 0, RDNS_SUSP 0, RDNS_SUSP_GENERIC 0, __ANY_URI 0, __CANPHARM_UNSUB_LINK 0, __CP_URI_IN_BODY 0, __CT 0, __CTE 0, __CT_TEXT_PLAIN 0, __FRAUD_INTRO 0, __HAS_FROM 0, __HAS_MSGID 0, __HAS_X_PRIORITY 0, __MIME_TEXT_ONLY 0, __MIME_VERSION 0, __SANE_MSGID 0, __SUBJ_ALPHA_END 0, __TO_MALFORMED_2 0, __URI_NO_PATH 0, __URI_NS '
>> >>
>> >> November 15, 2012
>> >>
>> >> Dear Colleague,
>> >>
>> >> You are invited to join the UVM domain in Collaborative Worlds (http://www.ccnets.org).
>> >>
>> >> In a move away from the traditional "Communicate" model to the new "Collaborate" model, a collaborative domain allows members to share common resources and to collaborate based on common interests.
>> >>
>> >> We hope everyone can achieve through collaborations, and we look forward to serving you.
>> >>
>> >> Sincerely,
>> >> Jeff Kitson
>> >> [log in to unmask]
>> >>
>> >> We apologize if you receive multiple copies of this message; to unsubscribe please mailto:[log in to unmask]
>> >
>> > Dawn Pelkey, BA
>> > Office of Health Promotion Research
>> > 429AR4
>> > 1 S. Prospect St., Rm. 4428C
>> > Burlington, VT  05401
>> > (802) 656-4117 Phone
>> > (802) 656-8826 FAX
>> > http://www.uvm.edu/~ohpr
> 
> Dawn Pelkey, BA
> Office of Health Promotion Research
> 429AR4
> 1 S. Prospect St., Rm. 4428C
> Burlington, VT  05401
> (802) 656-4117 Phone
> (802) 656-8826 FAX
> http://www.uvm.edu/~ohpr