I'd argue that cloning their intranet site takes this up a notch from regular phishing