Usually I differentiate phished page and normal web pages by seeing
https before the address of the web page, as the lock symbol will help us to identify.
Are there any other methods to differentiate phished login pages and normal web page?
Doing a test login with fake credentials I think is the best way. You could examine the Net using debuggers as FireBug (mozilla plugin) or Chrome debugger to look where the information is being sent, or if you are being redirected to other web etc.
Also you should pay attention to the domain,
Other way is searching it on google (or other search engine). Usually the real website would appear before, (but this is not 100% secure). Or you might even find that that phising web have been reported.
Usually checking the https is a good option, but if a trusted CA gets compromised, bear in mind that you could end up in a https web that is not the real web.
Edit: For users with not enough IT knowledge, I recommend not to trust links on unsafe environments, like an email from an unknown sender, a chatroom or a forum since most phising attacks rely on those mechanisms to succeed. I will be surprised if a phising website gets to the firsts possitions of a search engine...
Apart from paying attention to visible (at first sigh) things as the url, as I said before, or the httpS as vignesh said, there is little more they could do by theirown if they fall in a phising website.
I think they should totally use antivirus, nowadays they tend to warn you if a website is a phising website (at least Norton and McAfee do), this could safe lives, but of course, with new phising websites, I guess they will not warn you.
It's not really clear what you're asking here. Do you mean how would you as a user differentiate between a phishing site for a service you use and a legitimate site? Checking for SSL only differentiates if the legitimate site uses https. While the hosname is a also a good clue, it's not the full story - leaving aside SSL, there's lot's ways it can be faked. Checking for both SSL and a the host name will catch most problems - it's still possible to compromise the integrity of this approach, e.g. if the client machine has a compromised root CA database / DNS resolution.
Check the URL: The URL should not contain anything that looks like code or a URL for a weird website (i.e.
Next Also... warn them that they should check for the code after the page has loaded to avoid being confused between a shortened bit.ly link and the actual url.
Expectations: Your post on @eversor's post indicates you want a user to validate the page is not phished. A user is stupid. If they don't know things about how their computer works and how the internet works how can they be expected to understand what pages may be compromised...
Warn them to look for things that look out of place, make sure there is no code in the address bar, expect your users who don't know how phishing works to fall victim to it, and respond accordingly.
And use good browsers. Chrome and IE have surprised me at how well they stop most basic XSS.
One more thing. Here is a good link about phishing I just saw. "Phishing" red flags and countermeasures