This page is served by the malicious H2 server. The attack is server-side.

Navigate to https://localhost:8443/ to trigger.