> The advice I give my non-techie friends is avoid going to any business website that is not a “.com”

What about ".net"? It's a pretty old, established domain with many large companies using it (themeforest.net, cpanel.net, php.net, ovh.net, doubleclick.net)

Also ".io" usually hosts legit internet businesses.