"The way these things work is that they act like they're the real login form, steal your credentials and usually send you off to the real bank so you think you made a typo or something."
If that's the case then surely you're also flooding the bank's real site with GET requests after the redirection.
Even if, I'm sure the bank appreciates someone working against phishing. A few GET requests is something they're meant to handle. They have to be resistant to DDoS attempts from malevolent actors
If that's the case then surely you're also flooding the bank's real site with GET requests after the redirection.