Most of the time when your mouse cursor hovers over the “link” they are telling you to click, down at the bottom of your browser page will be the actual web address it will take you to. It usually looks weird.
I got an email like this once. Mousing over the link displayed a long but apparently legitimate URL. Too long to fully display. Being curious, I copied the URL to the clipboard and pasted it into an editor, so that I could see the whole thing. Turned out, the URL ended with an @-sign followed by a raw IP address, a slash, and some more gobbledygook.
The @-sign syntax is intended to allow URLs of the form:
http://userid:password@example.com/blah
IOW, the URL I was dealing with actually went to the IP address buried at the end, not to the apparent URL in the userid field. Cute.