Stop playing cat vs mouse and start using a physical hardware token as a 2fa. This makes it impossible to phish people because anything but the right domain gets a wrong key.