http://vww6ybal4bd7szmgncyruucpgfkqahzddi37ktceo3ah7ngmcopnpyyd.onion/zh/email/scams/phishing
It knows that some people know Riseup will never ask them for their password in an email, so it links to a webpage that asks them for their password. The link looks like a link to riseup page, but when you click on it it actually takes you somewhere else.