Field note / URL anatomy
Find the hostname.
Read all of it.
In a web URL, the hostname identifies the requested host. A company name elsewhere in the address does not establish who controls it.
Text before @ can be a distraction
In https://bank.example@delivery.example/verify, the hostname is delivery.example. The text before @ is user information. The browser's URL API treats username separately from hostname. These are made-up names, not live examples.
A name on the left is not the whole story
In https://bank.example.delivery.example/, the full hostname is bank.example.delivery.example. Reading only the familiar first words misses the rest. Compare the complete name against an independently known address.
Do not assume the last two labels always identify the registrable domain. Multi-label public suffixes and hosted services complicate that shortcut. LinkLens shows the full hostname without assigning an owner.
International names can change appearance
https://bücher.example/ parses to xn--bcher-kva.example. This ASCII spelling is a normal representation of an internationalized domain, not proof of fraud. Similar-looking characters deserve careful comparison. MDN documents hostname normalization, including international names and IP addresses.
The rest of the address still matters
The path selects a resource. The query carries parameters. Text after # is a fragment that page scripts can read. Any of these can include private information, and a server can redirect after the first request. A parsed hostname is only the starting address.
For an unexpected account or payment message, use your usual app, bookmark or independently known contact details. Reading a URL does not authenticate the message.