Yes, I agree that it's definitely tracking the url (and not the domain) but thet is not the same as key logging (which would capture things like passwords enter

Yes, I agree that it's definitely tracking the url (and not the domain) but thet is not the same as key logging (which would capture things like passwords entered into a web page). I'll take your word for it that the text keypad is just as compromised as the numeric, but it would have been a lot more compelling to show a username / password (for example) being captured on a banking website before the user even pressed "submit" (or whatever).