As a business they should probably just own the one dozen most likely phishing domains.

Just like e.g. Apple also owns applecomputer.com