OP, isn't it the punycode attack where they try to impersonate URLs and send Unicode to the address bar and make people believe that it's the original URL when most guys don't even bother to check where they are visiting?...
I don't see the exact phishing link in the OP but I am sure this is in 99% a Punycode (Homograph) Phishing attack.
Here is a detailed post about Punycode Phishing attacks, which I have written a couple of days ago: What is Punycode and how to protect yourself from Homograph Phishing attacks?.
Here a great example of Punycode (Homograph) Phishing attack:
The most tricky phising website i've heard was this one.Looks like Binance.com but there are no "n". This is strange n with dot at the bottom.
source
How to deal with such a phishing address? Those dots are almost unnoticeable.
source
How to deal with such a phishing address? Those dots are almost unnoticeable.