Forum Moderators: martinibuster
I've had spammers attack my site's mailform script, and the IP address changed every time, probably because they were using a distributed botnet.
The only thing that you can rely on in an email is the target. Where are they asking you to go to? And never trust the text of the link, always check the actual href attribute. (Usually this will appear in the status bar if you hover over the link. Otherwise you can right-click the link and select properties.) If the domain in the link is not [something.google.com...] then steer well clear. [google.something.com...] is completely different.
If you're not sure, email Google on an address you know to be safe (not the one provided in the suspect email, obviously).