That isn't weird. This should be default behavior for everyone. If it was fewer people would get caught by scams. I also look at the sender's email. All the ones I've ever received have come from domains not affiliated with the company they purport to represent. I've taught all my non-security savvy friends to do this, too.

It was shortened so wasn't immediately obvious, though not from a common URL shortening service - not that that matters too much. But I'm the same, better to be suspicious first.

Actually, i do too. When i get emails i expand to see the domain the message comes from and ProtonMail is set to ask me if i want to visit the full printed url before it allows the link to open. I have to click an okay button

I click all URLs for fun. They usually take you to those shitty survey sites. Then I just exit them. The fake links can't do anything unless you let them.

I sure do.