check against target's origin, not attacker's