AFAICT, this can be defeated with a suffixed domain that invites users to register. I.e., put a message board on a specialized domain (e.g. amazoncomplaints.co

AFAICT, this can be defeated with a suffixed domain that invites users to register. I.e., put a message board on a specialized domain (e.g. amazoncomplaints.com, somerandombank-watchdog.com) and then harvest the target passwords as users sign up...