> I'm pretty sure the requests still go to the attacker You are right, they do, it's just that the returned data is not allowed to be seen/used by the page --

> I'm pretty sure the requests still go to the attacker You are right, they do, it's just that the returned data is not allowed to be seen/used by the page -- the "l0.cm" server still got the information.