Test a suspicious URL locally
Use the structural checker before following an unexpected link. It parses the address without opening it. A shortened link may conceal a destination that this tool cannot resolve. If the link includes a token for an account, remove it before sharing evidence with others.
Lookalike and address tricks
Compare the actual hostname rather than the page title or brand text in a path. The fictional address [email protected] goes to other.example. A brand appearing in a subdomain does not establish ownership of the registrable domain. Local heuristics and the bundled suffix list have limits; verify unfamiliar names manually.
After clicking or submitting data
Record what happened without forwarding a live suspicious message to colleagues. If credentials were entered, use an independently obtained official site to change them and notify the responsible security team. Follow your incident procedure if a file ran or payment details were submitted. Report suspected phishing using approved official channels.