Don’t they usually try at least to have a domain that sorta looks like the original? It’s not like they use phishing.bigbank.abc.xyz - the domain isn’t supposed to look suspicuous