How about entering in a URL from an offline mention, whether that's a print ad, being mentioned in a podcast or shouted from the stage of an indie band playing in a bar? When I started a band in the 90s, there was a great deal of consideration made in choosing the name for there being an available domain name (at the time there were about two dozen English words which had not been registered as domain names, of which exactly one was a potential band name (osteoclasts) but we decided against that—we ended up with the suboptimal dream-in-color.net since the name was unavailable with neither dashless nor .com/.org options available). One important thing was that the domain name would be something that a semi-drunk person might remember later.

Non-technical people will likely not recognize four three-digit numbers separated by periods as being an address for a website.

And phone numbers have been largely supplanted by contact lists on phones (I've occasionally forgotten my own number). Looking over my call history, out of the last fifty outgoing calls, six are not in my phone book and all but one of these were dialed directly from search results on the phone.

Things like cloudflare "host" thousands of sites behind the same IP. Old-school shared hosting providers are doing the same.

We are moving to ip6 not away

AFAIK, there are exactly two ways to avoid getting phished. One is using physical security keys (not implemented everywhere and we can't expect everyone in the world to buy one). The second one is checking the domain you're in.

Please, do elaborate on what other ways of phishing preventions you have in minds.