This insecure page is served with an about:blank iframe. A script then adds a password field to it.