This is made worse by the fact that browsers don't show the intermediate domains in the address bar during a redirect. They used to, but stopped after attacks w

This is made worse by the fact that browsers don't show the intermediate domains in the address bar during a redirect. They used to, but stopped after attacks were found where you could make the URL in the address bar different from the contents of the page. For example, you could show a phishing site, then redirect to some URL on google.com that takes forever to load, and that would show in the address bar.