[masklinn]

Modern browsers will straight up tell the server the resource is being loaded from an iframe via Sec-Fetch-Dest.