This page contains a subresource whose <img src> points at
http://trusted-intranet.test:8080/redirect, which 302-redirects to
http://attacker-evil.test:8080/payload.bin.
To trigger: Save this page via Ctrl+S → "Webpage, Complete".
The saved subresource file will be MOTW-annotated using the
pre-redirect URL (trusted-intranet.test) as HostUrl,
rather than the actual content origin (attacker-evil.test).