This page auto-submits a browser-simple text/plain POST to
https://www.lookfantastic.com/fragments/responsiveProductTabs.
The browser will send Origin: https://www.lookfantastic.com.blackmail.zip,
which passes the server's prefix-based Origin check. The response renders on the
www.lookfantastic.com origin; click the product card titled
BBTITLE_9dXQ to fire the injected javascript: URL.
Submitting…