Theory question please.
Site 'A', contains an iframe to domain 'B', the html hosted on domain 'B' in turn has an iframe to domain 'C'.
A user is browsing site 'A'. Do they have a direct connection to domain 'C' or is their connection via the iframe hosted on domain 'B'?
Well they have a connection to A, B and C as its their browser that requests all the pages from all three domains, based on the iframe source urls.
Transactions via an iframe & an intermediate are specifically covered here.
In this implementation, the merchant should consider both third parties—the intermediate party hosting the iFrame and the third party processor who provides the iFrame—to be service providers for the merchant, and the merchant should monitor the PCI DSS compliance of both third parties.
