Preserve the reported message and extract the original URL safely using approved tooling.
Search mail telemetry for the URL, registered domain and relevant rewritten/protection URL representations.
Expand with related indicators such as sender, Reply-To, subject, attachment and sending IP.
Identify recipients and determine whether messages were delivered, quarantined, clicked or otherwise acted upon where your authorized security tooling provides that data.
Do not visit a suspicious URL from a normal workstation just to see what it does.