These examples are intentionally synthetic and use reserved example domains. They illustrate how several weak signals can combine into a stronger warning without exposing or promoting real malicious links.
Unexpected delivery text
https://parcel-update.example/fee
Caution- The message context is unsolicited delivery pressure.
- The domain is unrelated to the courier the message claims to represent.
- The page may request a small payment, which should be verified through the courier's official site.
Shortened account-reset link
https://short.example/a8x2
Inspect destination- The visible URL hides the final hostname.
- Resolve the redirect before signing in.
- A legitimate short link can still be risky if the final destination is unexpected.
Lookalike login domain
https://account.example.com.security-check.example.net
High caution- Trusted-looking words appear on the left, but the controlling destination is under example.net.
- The URL contains account and security language.
- Do not enter credentials until the official domain is independently verified.
Suspicious sender address
billing@secure-account.example
Verify sender- The display name is not evidence of sender identity.
- The domain should be compared with the organization's known official domain.
- Authentication records can add context but do not prove the message content is legitimate.
QR code to an unfamiliar host
https://verify-ticket.example/session
Caution- A QR code hides the destination until decoded.
- Read the decoded hostname before visiting it.
- Unexpected payment or login requests after scanning deserve independent verification.