The link and the file are different evidence
A normal URL does not prove that a file is harmless. This site does not upload or execute files, scan binaries, validate publisher signatures or inspect archives. Use your organisation’s approved endpoint and download-verification process.
Attachments, QR codes and shortened links
Be cautious with unexpected attachments and requests to enable active content. A QR code or shortened link hides information until its destination is inspected; a local address check still leaves live content unverified. Obtain expected files from an independently confirmed official source.
Escalation example
A fictional invoice message asks you to enable macros. Do not enable them as a test. Preserve the message according to your incident procedure and ask IT to analyse it in an approved environment. Record whether the attachment was opened or executed; those are different incident facts.