Turn legit URL's in something phishy

https://cheap-bitcoin.online/payload-dropper/trojan-controll...

No script addon catches it as an XSS attempt.