What I want to say is that services like this have a security flaw by design which allows random people to execute strange statements in the name of Hurl.
There are certainly other ways to execute malicious HTTP requests (for example, let the Google Bot do it), but still, it should be pointed out.
Hoping that an attacker can't use curl probably isn't a good security solution...
It is a difference, whether an attacker uses his own IP address (or a setup with various VPNs and proxies) or uses Hurl for it so that the target website sees only Hurl's IP in its logs.
In times of free WiFi, the traceability of malicious requests is definitely reduced anyway, but Hurl could potentially add another layer that can be used by an attacker to obscure his/her origin. I'm not saying that this is a major security issue, it is just a flaw by design, which I wanted to point out.
If an attacker is relying on using Hurl as their only source of anonymity they're not very competent.