This is truely impressive! I've never before seen a domain registrar risk money to test if a site steals from their customers.
What happens to those phishing domains in the long run? Will they become available again once their registration expires in the future, or will they stay locked forever?