nothing stopping server side logic: if request.ip != myvictim, serve no malicious payload.