Again, as usually, the link is 'masked' and the sender is spoofed, so it looks as the message comes from the legitimate domain.

Another interesting point is the mention of 'SAFEedible' at the bottom - which creates a sense of affiliation with the site later opened.

The really tricky part is that the phish site acts as a 'man in the middle' beween the victim and the legitimate site. It will store the entered information and then it will pass it to the legitimate site's login URL. This way, if a correct information is entered, a normal login into the legitimate site will proceed, and the victim will not notice anything.

The scam site is hosted on a legitimate domain in China. Probably the scammers have obtained remote access to it, using some kind of malware. And there is always the possibility of an 'insider'.