Lately, I've been really into on-chain "coincidental transfers": A sends money to B, then B sends to C after two minutes. It looks like a script on the surface, but many can actually be broken down into paths—like the same consolidation address in transit, exchange hot wallets distributing funds, or a contract batch paying out being mistaken for "someone watching you."

I usually start by straightening out the timeline, then eliminate common roles (exchange/bridge/contract), and only then do I continue to guess.
By the way, hardware wallets have been out of stock lately, phishing links are everywhere, and everyone's security awareness has definitely improved... But don't just be nervous in words; for addresses/domain names, taking screenshots and saving them as memes is also fine. It can really save your life at critical moments.
Anyway, now I take a screenshot before clicking any "airdrop/claim," and take a three-second pause.