DemoDApp — VICTIM frame · real origin: …
Sign-in by signature (static "Sign in to X" message — a real pattern). The wallet popup names ONLY this origin.

1. Connect wallet 2. Sign in with Ethereum

↓ Unrelated cross-origin iframe on a DIFFERENT site/backend (no request, no popup):