That’s precisely the role of Protective DNS. The phish tries to get a user to act, usually by clicking on a link and visiting a criminal-controlled website that purports to be something innocuous and, ...