Malicious sites use JavaScript... Note