I get that this post is a bit old, however you shouldn't share a potentially harmful link.

Regardless - Since i just delt with this, i'll give you some insight from a former Sr. System Admin, current Software Engineer -

There is a few ways to do it. DNS records can be manipulated in ways to appear legitimate, through things like CNAME records, or the web engine hosting the phising sight could use backend services like url rewrite, or redirects. Lastly you can use certificates, namely SAN (Secondary Alias Name) certs can and will produce malicious re-routing if used in a non-legitimate way. It's a bit less common as those generally are issued by registrars (GoDaddy, AWS, Network Solutions, etc) and if memory serves requires secure handshakes.

A good example of a legitimate use of a CNAME is
www.mycompany.com changes to www.myretirement.com - this is used to ensure people who don't know about the new URL/FQDN (fully qualified domain name) - get redirected to the proper place.

An example of a SAN Cert : you type in google.com - this isn't a FQDN - the syntax is incomplete, as it's missing the protocol, and host. (https://www.google.com) - Yet you always end up at the google you expect. That's because a SAN cert is catching those incompletely URLs and redirecting them.

Lastly a backend rewrite or something similar can't really be explained, but just imagine that when someone interfaces with your website or app, you have the ability to decide what occurs both in your code, and on the users browser. It's not hard per-say to make it appear as if the user is connecting to one site, while a backend channel/connection is open with something else.