It matters because deep-linking is possible on the web. Hiding it just seems like a trivial UI matter that makes things slightly more obnoxious when you do car

It matters because deep-linking is possible on the web. Hiding it just seems like a trivial UI matter that makes things slightly more obnoxious when you do care. I'd be surprised if only showing the domain vs domain+path made any difference on phishing results. I don't think these little tricks do much for the user. For example, browsers now highlight https websites with green in the url bar and show a little lock icon. But how is that actionable information for the user? To what extent does that mean you can trust that website, and how does the average person interpret it? Phishing websites use https, too. I would avoid stealing any pages from Safari's UI. That browser doesn't even show favicons on browser tabs to let you quickly distinguish them.