Is this attack mitigated by checking the destination address?