If they check the domain, chain it with another open redirect in the same domain.