Here’s something I posted in the past, but it’s something people should really understand.
A website often has subdomains. A subdomain means that it is really just like another folder on the site but instead of google.com/search it would be in the form of images.google.com. The address of the site is the last part, “google.com”.
Often, a spam email will tell you to log in to your PayPal account by clicking on a link. Always look at the link. If it is from payPal it would say paypal.com. If it is a fake it would say, paypal.jkygt.com. Remember, the site is jkygt.com, and they made themselves a folder called paypal.
Even when the link in the email says paypal.com it could still be that it is only the text of the link, while the underlying link is somewhere else. So, to see what the link is, either right-click and copy link or mouse over and look at the bottom.
Another thing is that you look at the email headers. Any large enough company will have its email coming from its own server, and not some obscure server in Vietnam.