Put file:// in front of any site URL and instantly see if it’s on an insecure shared host, then hijack their entire account. @HostGator