What attack is "hovering" trying to prevent, phishing or executing a malicious page? If phishing, it's much more important to look at at the URL after the pag

What attack is "hovering" trying to prevent, phishing or executing a malicious page? If phishing, it's much more important to look at at the URL after the page is loaded. URL shorteners already obscure the actual destination much of the time. If malicious pages, well, if an attacker can present a link with a JavaScript onclick handler they can most likely already inject an iframe or redirect you to a malicious page.