"hovering over the links showed something entirely different from what it said they were. "

If your browser will do this, it is a dead set easy way to expose the fraud.