Based on this thread in emacs-devel list [1], and I found that
suspicious links inside orgmode are not detected
I did a patch in my emacs config that when there is a suspicious link,
it faces it with org-warning, I did it this way
Consider if something like this should be there by default, when you
have a URL in your orgmode notes, you might click on it
I attach the patch I did to my config if it serves as inspiration, here
is my commit [2].
[1] Detecting and warning about homoglyph attacks
https://lists.gnu.org/archive/html/emacs-devel/2026-09/msg00430.html
[2]
https://codeberg.org/pedroberg/pinmacs-emacs-config/commit/e5c5fd9d0c1217a8ce201cbccb8b1b2f078978fb
From e5c5fd9d0c1217a8ce201cbccb8b1b2f078978fb Mon Sep 17 00:00:00 2001
From: pinmacs <[email protected]>
Date: Thu, 24 Sep 2026 11:51:59 +0200
Subject: [PATCH] org links http/s: check textsec-url-suspicious-p
---
emacs-config.org | 10 ++++++++--
1 file changed, 8 insertions(+), 2 deletions(-)
diff --git a/emacs-config.org b/emacs-config.org
index 3e73d89..6278c9b 100644
--- a/emacs-config.org
+++ b/emacs-config.org
@@ -5318,7 +5318,10 @@ other locations such as http and https
"Face for web links."
:group 'org-faces)
(org-link-set-parameters "http"
- :face 'org-link-http-custom)
+ :face (lambda (path)
+ (if (textsec-url-suspicious-p path)
+ 'org-warning
+ 'org-link-http-custom)))
;; by default firefox
;; but for certain videoconferencing stuff, I want to open with google chrome
@@ -5334,7 +5337,10 @@ other locations such as http and https
(browse-url-default-browser full)))))
(org-link-set-parameters "https"
- :face 'org-link-http-custom
+ :face (lambda (path)
+ (if (textsec-url-suspicious-p path)
+ 'org-warning
+ 'org-link-http-custom))
:follow 'my/https-visit)
#+end_src
