High-confidence Adversary-in-the-Middle (AiTM) credential harvester matching Evilginx + GoPhish kit signatures, impersonating Microsoft Entra ID behind Cloudflare Turnstile.
IDN homograph, obfuscation and PSL abuse
Logo match and phishing impersonation
Credential harvesting forms and sandbox risks
27-category scam taxonomy and lure urgency
Bulletproof ASN, GeoIP and PTR reputation
Certificate chain, HSTS, CSP and hardening
Beacon failures and malicious trackers
Zero-hour domain age and registrar risk
Rogue ad scripts and deceptive trackers
Version-matched OSV.dev CVEs and DAST
DOM & network waterfall matched `/phish/` & `?rid=` URI markers and session cookie relay heuristics used by Evilginx/GoPhish.
ORB visual descriptor and favicon hash matched Microsoft login assets on an unauthorized lookalike domain (`micros0ft`).
RDAP/WHOIS intelligence confirmed domain was registered 19 hours ago via privacy-shielded registrar on high-risk hosting ASN.