I like (hate actually) that my works security training about recognizing suspicion domains, which includes tips to watch out for suspicious domains or TLDs, is provided to me in an email I have to click, in a link that is my org (subdomain), then someone else's site that is not under my org's domain or TLD. Feels like a joke.