It seem that phishing messages are find ways around spam filters. This falls on the ICANN who handed out registration to unsuitable miscreants. Now everyone is being bombarded by ruses galore.
One message today said there were now AirPods but it did not come from Apple, it was from a .de domain that looked like it was recently generated.
The phishing is designed to trick people into being ripped off with counterfeit products and worse. Over the last few years the spam volume has increased dramatically. Spammers use URL shorteners and image hosts to prevent tracing.
Notice how the phishing message has a fake product message. The graphic on the image host has the text so its not possible to filter easily. The image is embedded in the message along with 2 or more URLs.