The barrier to vising a "sketchy website" is minimal. For example, its super easy to have an s3 bucket that serves static html content and get a user to click on it is minimal, not only does the url look valid, but its a common way of hosting content so https is not present.