Also, consider the structure of the URL. Domains that mimic legitimate sites to trick users are often involved in phishing. If there are many similar domains, that might indicate a pattern. For example, some phishing sites use subdomains that slightly misspell real brand names.