Most of these phishing sites have unpopular domain extensions because on popular domain registrars, you can buy bulk domains at a very cheap price, especially on their anniversary sale, there are domain registrars that have extensions that offer $2 or even lower
The creators are developers and coders and it's easy for them because it's an automated smart contract script, all the victim will do is connect their wallet and they can employ their scheme, it's very easy for them and these hackers' scheme thrives on victims' ignorance.
This means that for around $50, these scammers can create dozens of domains and place their script for the automated smart contract on an HTML template that mimics the basic interface of the original domain for any project or platform. They promote their poor tricks on social media in the hope of trapping a victim with limited experience. And they steal and deplete his wallet assets, which will compensate them for the few dollars it costs them to create their phishing sites.
Without naming the domain registrar as I don't want to give hackers and scammers a tip, you can buy a domain extension for as little as $2, so yes $50 will give you not only a dozen but more than 2 dozen new domains It is not .com or TLD top-level domain but still popular domain extensions.
So, the solution, as mentioned by Hugeblack, is to educate beginners through information and advice adequately. If the protective measures are firmly embedded in their minds, they will be able to avoid any phishing websites they encounter. This is because there are countless phishing sites that cannot be counted.
That's the best solution, scammers will always scam and hackers will always scam so we should not stop educating people on how to stop these scammers and hackers, they keep innovating so we should always expose their schemes.