It’s common in phishing schemes to either have a non-functional site hosting only the payload or one that hosts a full front appearing like a normal website, usually a blog with news.