🪪 Legit-Service Phishing — Test Range

A brand login presented on a trusted platform whose owner isn't that brand = credential phishing abusing a legit service. (Test fixtures declare the platform via a test-origin-only meta.)

⭐ forms.office.com page that asks for a PASSWORD (cleanest test)
Expect: legit-service-phishing ALONE (no brand login → sso-clone stays silent) Microsoft login "hosted on" canva.com
Expect: legit-service + sso-clone (sso-clone owns the headline; legit-service is a contributing feature)