So an attacker just needs to be better at SEO, or they need to register a domain. The problem still lies with visiting untrusted domains rather than the obfusca

So an attacker just needs to be better at SEO, or they need to register a domain. The problem still lies with visiting untrusted domains rather than the obfuscation of the URL by a QR code.