On the topic of trusting domains, big companies are not helping themselves. Lets use a big financial company as an example.

I recently got an email from them to check on a transaction that settled, the domain was:

https://click.SOMECOMPANYNAMEHEREinvestments.com/? ...

Their real domain is SOMECOMPANYNAMEHERE.COM but as you see they made a special domain just for email clicks. I thought at first this was a scam email, but then tried clicking and sorted out that it redirects to the real site and login.

But man you can't even easily trust real emails if you're paying attention, i dont know how regular people will defend against stuff like this.