setup yubikey with domain.com login to domain.com enter username/password to domain.com, it then demands domain.com yubikey authn token. yubikey provides only

setup yubikey with domain.com login to domain.com enter username/password to domain.com, it then demands domain.com yubikey authn token. yubikey provides only if on domain.com login to fakedomain.com enter username/password to fakedomain.com, it then demands domain.com yubikey authn token. yubikey does not provide because not on domain.com. or it demands fakedomain.com token, but yubikey doesn't have it so, in that way, yubikeys (and similar) are immune to phishing, unlike say google authenticator