“it's just a lookalike phishing link”

In a way, yes, but embedded in a thick thick layer of social engineering