Earlier quoted context omitted.
Lack of moderation combined with an offical-sounding domain name. This would have to get the user to follow a link or call a phone number or something though. These are plausible. It's too bad the content-security-policy can't prevent following links.
Bluesky seems to use a lot of totally different domain names for each part of their infrastructure, maybe for this reason. e.g. this one is bsky.network While they're nowhere close on volume, they're certainly beating microsoft in terms of the rate they're adding similar looking official URLs.
Shortening your brand to 4 letters when your chosen TLD is the same length as your full brand name is such a weird choice.