{"success":true,"data":{"id":"href-at-symbol-trick","label":"Link uses the @-symbol URL trick to hide the real destination","description":"A link href contains an @ symbol in the authority component, e.g. `https://paypal.com@evil.com/login`. RFC 3986 defines the part before the @ as \"userinfo\" which browsers ignore — the real destination is `evil.com`. Users see `paypal.com` at the start of the URL and trust it. No legitimate sender formats URLs this way.","tier":"danger","category":"other","isThin":false}}