What should I do with links in a suspicious email?¶
Preserve the link exactly as delivered and examine it through an approved, controlled process. Do not click it from an ordinary work device merely to see where it goes.
The visible text may not be the destination¶
An HTML email can display a familiar address or instruction while linking elsewhere. Preserve the native message, including both HTML and plain-text MIME parts, then record the displayed text and underlying URL separately. Buttons, images and apparently empty regions may also carry links.
Keep the original URL string, including encoding, parameters, fragments and unusual characters. These details can identify a recipient, campaign or transaction. If the mail interface cannot expose the destination safely, extract it from a working copy of the raw message rather than interacting with the original.
Account for security rewriting and redirects¶
Mail-security products may replace a destination with a protective link that checks or redirects at click time. The delivered wrapper and the original destination are separate evidence. Preserve both, along with any provider record of scanning, blocking, verdicts or clicks.
Public reputation and sandbox services may visit a submitted address. That can notify the operator, consume a one-time token, change the page or disclose case information. Confirm what an analysis tool does before submitting evidential material.
If the recipient already clicked, record the time, device, browser, redirects and resulting actions. Browser history, DNS or connection logs, endpoint telemetry, downloaded files, security-service events and account records may describe what occurred. A destination's present behaviour does not prove what it served earlier.
Key takeaway
Treat a suspicious link as evidence: retain its exact delivered form, distinguish wrappers from destinations and use controlled records to establish whether it was visited and what followed.
