The UK. domain is one of the few that used to reproduce and enforce (almost) the gTLD hierarchy under itself, thus CO.UK., ORG.UK., GOV.UK., etc. (They gave up several years ago I think.)

(Unlike with almost every other ccTLD, UK is also not the ISO code for the country—GB is—and is instead “reserved”, which is why I must struggle to remember each time that the BCP 47 for Ukrainian-in-Ukraine is uk-UA.)

.au used to be third-level only too (or fourth-level in places, e.g. *.vic.edu.au for the state of Victoria), with careful rules about each, including things like requiring that the name match your business/whatever, trademark, or something your business sells or does (which eliminates the vast majority of squatting in theory without the additional “no squatting” rule, and in practice there wasn’t much, and also ensures surprisingly high quality of domain name meaningfulness and relevance), but this year they started doing second-level registrations with almost no rules, just about a free-for-all, after years of “public consultation” concluding with carefully-worded reasoning that I will uncharitably simplify to “why not?”, “we’ll make more money that way” and “everyone else is doing it”.

The sad fact of the matter is that structured and controlled ccTLDs where you knew what you were dealing with from the name alone are increasingly being supplanted by second-level domains.

A bit of internet trivia is the oz.au domain. In the late 1980s, the Australian universities were connected in a network with names ending .oz.

When the TLD .au arrived, .oz was renamed .oz.au. So my email address at Elec Engineering at Melbourne University was <name>@ee.mu.oz.au.

And then a few years later, the third-level structure got formalised. Melbourne Uni, for instance, switched from mu.oz.au to unimelb.edu.au.

I for one missed the typographic economy of the ee.mu.oz.au domain.

None of this really matters, of course, except that a sensibly designed structure with a clear underlying rationale, and historical context for a small number of exceptions, makes everything easier to understand :)

Yeah, those old *.mu.oz.au subdomains seem to have steadily disappeared. When my eldest brother was there somewhere around 2005–2010 Computer Science were still actively using cs.mu.oz.au (I think all their email and web stuff was still there), but even that seems to have lost its A records now, though it’s still got a third, interesting NS record (compared to ee.mu.oz.au which has only two boring NS records, edns-*.unimelb.net.au), mulga.cs.mu.oz.au, which is still talking A.

Another bit of historical trivia that now becomes mundane: csiro.au.

Of course, NemID isn't actually a Government website, despite being used by the Government. Similar situation as Sweden's BankID.

And then when users fail to phishing: "users are so stupid and easy to trick… it's impossible to make things safe when people are so gullible"