After reading the comments here, it seems like the attack would indeed assume you spread the alternative URL with the .html extension through other means like I

After reading the comments here, it seems like the attack would indeed assume you spread the alternative URL with the .html extension through other means like IM, ...