http://example.com/your/action?host=phishingscam.example&path=login

link_to 'View Something', params.merge(format: 'xlsx')

http://phishingscam.example/login.xlsx