An ordinary, unrelated website. The visitor never navigates to the attacker's domain and never clicks anything on this page.
PoC note (CAKE / Clockify extension): this page embeds a hidden cross-origin iframe to
https://app.myfocusspace.com/. Because the extension registers its integration content
scripts with allFrames:true, they load inside that iframe and the exfiltration runs
without the visitor ever seeing the attacker's domain.