Comment by reddozen

nothing stopping server side logic: if request.ip != myvictim, serve no malicious payload.