Attacker's page on a different domain