Important to note that the fake page is "frozen", so there is no direct phishing risk. The user can click around but nothing happens. Scrolling works. Resizing curiously turns it into a blank page. Reloading leaves the fake page up.

It's a race, so it might not work at the first try over the network.

Original report: http://seclists.org/fulldisclosure/2015/Jun/108