The HTML file with our embedded port scanning JavaScript is placed on some other domain, which will be a publicly available server in the general case," the researchers explain.