Top 2026 2FA & AiTM Detection: Newly Registered Domain Cloning IdP Login Page

Ibrahim Saud@tektrix

•updated 11 days ago•0•0•1

Detects web-proxy or webserver log activity associated with domains registered within the last 30 days that mimic branding or structure of major identity providers (Microsoft, Okta, Google, Duo). This behavior is characteristic of adversary-in-the-middle (AiTM) phishing infrastructure staging.