🛡️ AiTM / SSO-clone — Test Pages

Adversary-in-the-Middle / reverse-proxy phishing detection. Extension ON, watch the service-worker console + dashboard.

Most fire on page load. HIGH shows the BDR block page. The image test proves the anti-evasion OCR layer — it only detects once Tesseract is vendored (the others work now).

Kit fingerprint + credential relayhigh

Reverse-proxy kit marker (evilginx) + cross-origin credential POST.

Microsoft SSO clone — visible texthigh

Layer 1: matches the visible Microsoft login on a non-Microsoft domain.

Google SSO clone — visible texthigh

Layer 1: visible Google login on a non-Google domain.

Microsoft clone — TEXT AS IMAGE (evasion)high

Layer 2 OCR: login rendered as an image to dodge text scanners — OCR still catches it.

Negative control — generic loginnone

Password field but no brand SSO signature → must stay silent.