How's that different from the trivial phishing, when a malicious site looks like the target site and asks for the password?