But then the attacker URL will be different. That doesn't look like a new attack...

		rmbyrro on Sept 7, 2023 \| parent \| context \| favorite \| on: Show HN: Host a Website in the URL But then the attacker URL will be different. That doesn't look like a new attack vector, this is called phishing, isn't it? XSS means you can inject and persist code in a webpage maintaining the same URL accessed by other users. If you create a bigbank-fake.com and copy a manipulated version of bigbank.com's HTML, this is not XSS.

Correct, except that in this case ALL the sites use "bigbank.com"