LEGIT dApp — VICTIM frame
this frame's real origin: …
The user connects + signs HERE. The wallet popup names ONLY this origin.

1. eth_requestAccounts 2. personal_sign 3. eth_signTypedData_v4 (ERC-2612 Permit)

↓ Below is an unrelated cross-origin iframe on a DIFFERENT site/backend that issues no request and gets no popup: