[hombre_fatal]

That's not the only URL-related attack surface.

e.g. "Log in to receive your bitcoin: https://colnbase.com" (phishing)