3 ms·

Then the scammer can use let's encrypt. The solution should be that window.opener shouldn't work cross-domain.