decoy.html
Location API targets an external URL
SHA-2568d765335671b54b40309bfb03a3a0010c89905c2218b3eeeb460199858ddde2c
MaleculeH(U)
Evidence
⋯6 lines
7<script>
8function myFunction() {
9 location.replace("https://bongo.cat")
10}
11</script>
12
13</body>
14</html>