AiTM / SSO-clone test (Layer 1 — visible text). A Microsoft login on a non-Microsoft domain → BDR matches the visible text → HIGH sso-clone.