Maybe Ramrod could post the HTML code behind the email? Cut and paste the email as you see it and you won't capture the dodgy URL behind the seemingly real URL. Like this:
http://www.hsbc.co.uk Always assuming there is a dodgy URL - usually there is otherwise the email is pointless
