Martin, thanks for the explanation. I checked SURBL and it turns out they had already blacklisted the URL.
I seem to vaguely remember getting a "no entry" mouse pointer when pointing at a blacklisted URL, which did not happen this time. Today I tried clicking it. I got a dialog box warning me about phishing, so everything works just fine. So my memory is probably not just vague, but plain wrong. (I realize that checking every URL up front would lead to a lot of network traffic.)