Update: their phishing site is down for now, I reported them to their Russian hoster, who took immediate action and locked them.