Hmm... i've received a couple spam emails saying please login into 'this' page (replica of bank/email/your life/etc sites)... so perhaps combination of both?? Really, with 100m botnets around, it could be true!