unless you make sure to very closely check the URL.

or you use random passwords + password manager, which auto-fill won’t work in the fake domain.