2 · AiTM / reverse-proxy HIGH

Reverse-proxy phishing (Evilginx-style) relays a real login and steals the session. This page carries a kit fingerprint AND a login form that posts credentials cross-origin to a real IdP — either triggers the detection.
A detection fires on page load (the kit fingerprint) — no need to submit.
Expected console: [BDR] DETECTION [high] aitm: Reverse-proxy phishing kit detected (evilginx) — immediate block · Dashboard: bdr:aitm incident.