> Does this mean, we must really embed "victim.html" [?]
Yes, you must use the exact url "victim.html".