What should I do with links in a suspicious email?¶
title: What should I do with links in a suspicious email? subtitle: Preserve the displayed text and the underlying destination without clicking the link from an ordinary device. slug: what-should-i-do-with-links-in-a-suspicious-email series: email-evidence section: content-and-attachments card_type: question_card pathway_order: 24 section_order: 2 status: draft public_safe: true video_ready: true word_count: 633 estimated_read_time_seconds: 262 audiences: - investigator - supervisor - fraud and compliance practitioner tags: - email evidence - URL - phishing - Safe Links - preservation sources: - title: 'Gmail Help: Avoid and report phishing emails' url: https://support.google.com/mail/answer/8253?hl=en-GB - title: 'Gmail Help: Click-time link protections' url: https://support.google.com/mail/answer/10173182?hl=en - title: 'Microsoft Learn: Safe Links overview' url: https://learn.microsoft.com/en-us/defender-office-365/safe-links-about - title: 'Microsoft Learn: Submit messages, URLs and attachments for analysis' url: https://learn.microsoft.com/en-us/defender-office-365/submissions-admin - title: 'RFC 2045: Multipurpose Internet Mail Extensions (MIME) Part One' url: https://www.rfc-editor.org/info/rfc2045/
What should I do with links in a suspicious email?¶
Preserve the displayed text and the underlying destination without clicking the link from an ordinary device.
Script¶
You’ve found a link in a suspicious email and want to know where it goes.
Don’t click it from your normal browser or work device to find out.
Treat the link as evidence first.
Preserve the complete original message, including its HTML and plain-text parts. The words visible on screen may not be the underlying URL.
A link may display:
“View invoice”
“Reset password”
or a familiar website address.
The actual destination may be different.
Record both.
Where the email client allows it safely, inspect or copy the underlying URL without opening it. Be careful not to trigger a preview, security scan or accidental visit through a careless click.
If you can’t obtain the link safely from the interface, extract it from a working copy of the raw message using the appropriate technical process.
Preserve the exact original string.
Don’t tidy it up.
Keep capitalisation, encoding, parameters, fragments, long identifiers and unusual characters. A single parameter may identify the recipient, campaign, account or event.
Also preserve the surrounding text and which part of the message contained it.
The HTML version and plain-text version may contain different links. A button, image or invisible area may be clickable even when the visible wording looks harmless.
Expect security rewriting.
Email providers and organisational security products may replace the original destination with a protective URL. Microsoft Safe Links and some Gmail protections can rewrite or proxy links so the service can check them at click time.
The URL shown in the delivered message may therefore identify the security service rather than the final destination.
Don’t strip the wrapper away and discard it.
Preserve the rewritten URL as received. It may contain identifiers linking the message, recipient and security event.
Then identify the original destination through the provider’s supported tools or by carefully decoding the structure in a controlled process.
The provider may also hold records showing whether the link was scanned, blocked, visited or assessed as malicious.
Be cautious with automated analysis.
Submitting a URL to a public reputation or sandbox service may cause that service to visit the destination. The site operator may record the visit. A one-time token may be consumed. The page may change, disappear or react differently after being accessed.
The URL may also contain personal, organisational or evidential information that shouldn’t be disclosed to a public third party.
Use approved tools and understand whether they fetch the page.
If the recipient has already clicked, record what happened.
Which device and browser did they use?
What time did they click?
What page appeared?
Did it redirect?
Did they enter credentials, approve a login, download a file or receive an error?
Did the email-security service display a warning?
Don’t ask them to repeat the click.
Look for browser history, DNS and connection records, endpoint telemetry, downloaded files, provider click records and account security events.
Also remember that the destination may have changed.
Shortened URLs, compromised websites, cloud-storage links and redirect chains can be altered after the email was delivered. A safe result today doesn’t prove what the recipient saw yesterday.
Preserve contemporaneous provider detections, screenshots and endpoint records where available.
The common mistake is:
“I hovered over it and the domain looked fine, so the link was safe.”
A familiar domain may host attacker-controlled content or redirect elsewhere.
The other mistake is:
“The security wrapper is the malicious address.”
It may only be the organisation’s protective redirect.
A careful report might say:
“The HTML part contained this displayed text linked to this URL as delivered. The URL was rewritten by this security service. Provider records identify this original destination and record the following click or verdict.”
That shows each layer.
Don’t use the link as the investigation tool.
Preserve it, understand any rewriting, and examine it through the systems designed to do so safely.
Key takeaway
A link is evidence before it is a route to visit. Preserve its exact form, then use safe analysis and provider records.
Related questions¶
- What should I ask the recipient not to do?
- What is a tracking pixel?
- Why might the plain-text and HTML versions differ?
- How do I preserve an email properly?
Source notes¶
- Gmail Help: Avoid and report phishing emails
- Gmail Help: Click-time link protections
- Microsoft Learn: Safe Links overview
- Microsoft Learn: Submit messages, URLs and attachments for analysis
- RFC 2045: Multipurpose Internet Mail Extensions (MIME) Part One