On: Blocking Top-Level Navigations to Data URLs for Firefox 58

[beefhash]

That requires that you know what you're doing, though. Non-technical people are probably more inclined to think along the lines of "huh, odd, but everything looks fine, so it's probably my fault it looks like that"

[ascorbic → beefhash]

In that case why bother with using a data url at all? They could just use "www.paypal.com.cgi-bin.webscr.xxxxxxxxx.myevilsite.com"

[beefhash → ascorbic]

That way, they don't have to bother with a domain registration, either. A domain registration is neither free of charge nor entirely free of risk.

[code_duck → beefhash]

They could just create subdomains on a compromised domain they control belonging to someone else.