The weird domain stuff is something related to SSO I feel, and it is HIGHLY indistinguishable from phishing.

So all the "just be smarter" talk from ten years ago about checking your domains, etc is out the window. scammerbillz.biz is ACTUALLY your hospital billing service, too bad.