what is it called when websites that look like legitimate sites are used to collect private information for malicious purposes?

I say phishing

correct.