Attacker Page: This iframe immediately redirects to a mobile URI scheme (e.g., geo:).
If the Arc iOS bug is present, the parent tab's address bar may show this origin even while the top-level victim page remains visible.