[thraway2016]

Crafted-content UAF vulns are still occasionally being found in browsers.

To say nothing of unpatched/non-updated browsers.

[Dylan16807]

You don't need a trick URL for those.

[thraway2016]

The point is that simply clicking a dodgy link can, in some cases, own you. No credential acquisition required.

[Dylan16807]

Yes but what does that have to do with the article?

[diminoten]

Are you asking what a dodgy URL has to do with the article?

[Dylan16807]

If they get you to click on a link, it doesn't matter what it looks like in the address bar. So what does a malicious link that could be on any domain have to do with domain spoofing?

[diminoten]

If you hover over a link in a browser, the URL of the link will be shown as a tooltip, or in the bottom of your browser window.