A phishing page can look almost identical to a real service and still have a valid HTTPS certificate. Visual polish is therefore weak evidence of identity.
Start with the hostname
Read a long hostname from right to left. In paypal.account.verify.example.com, the important registered domain is under example.com; the word “paypal” in a subdomain does not make it PayPal.
HTTPS is not reputation
TLS protects the connection to the domain you actually visited. A phishing operator can obtain a legitimate certificate for a deceptive domain they control.
Watch for high-risk requests
Unexpected password prompts, one-time codes, software downloads, wallet approvals and signatures deserve extra scrutiny. If a message claims there is an account problem, opening the official app manually is often safer than following the supplied link.
For shortened or unfamiliar URLs, inspect the redirect chain here: