Find fake login pages that get past two-step login
In a man-in-the-middle attack (adversary-in-the-middle, or AiTM), a fake login page on a domain like yourcompany-login.com passes what you type to the real site. The criminal gets your password, the two-step code and the logged-in session. We find those domains and get them taken down.
Codes and app prompts do not stop this. Hardware security keys do.
In our consultancy case, a copy of the company’s website with a valid padlock sat on a free hosting platform, with no lookalike domain behind it. The certificate logs and the website marker found it.
It is a copied-website case, not a relay one, and it shows the two checks a relay page cannot avoid. One report with the evidence went to the hosting platform on the day the copy was confirmed, and about 24 hours later the copy was offline.
Three ways logins get stolen, and the one we cover
How a man-in-the-middle login page works
Fake login pages we find
Each of these sits on a web address made to look like the real company's.
Who it is for
Usually IT and security. In a small firm, whoever looks after Microsoft 365.
IT and security
Know which addresses to block
Each alert carries the domain, so it goes onto your web filter or sign-in rules while the takedown runs.
Microsoft 365 and identity admins
The evidence in one alert
The lookalike, its certificate and the evidence pack, so you can check it against your sign-in logs.
Owners and directors
No security team needed
On Pro, one person reads each alert and approves a takedown with one click. On Enterprise, our analysts do it for you.
SOC and incident response
Alerts in your own tools
Alerts go by email, Slack, Microsoft Teams, SMS or webhook, or into Splunk, Microsoft Sentinel or Wazuh, with the domain and what was found.
What your current defences do not see
All four are worth keeping. None of them watches the web addresses made to look like yours.
How we find a relay page and get it taken down
Give us your domains. The first two checks need nothing else; the website marker is optional.
Step 1
We list lookalikes of your domains
Around 500 per domain, including your name plus words such as -login or -sso, letters that look the same, and other endings such as .co. Each one is re-checked every hour.
Step 2
We watch new certificates
A relay page needs a padlock: without one the browser marks a login form as not secure. The certificate behind it is published in public logs, and we watch 100+ of them as entries appear. In our software-group case, the certificate for the cloned site was matched within seconds of being logged.
Step 3
We hear when your page is relayed
The website marker is a small script or a 1×1 image on your login page. A relay passes your real page through, marker included, and when it loads the marker reports the address it loaded on. If that is not your domain, we alert you with that address.
Step 4
You confirm, we report and follow up
When you confirm it is a live attack, one click sends the evidence to up to 12 places at once: the registrar, the host and the email provider the lure went through, an abuse-report network, blocklists and threat feeds, browser warning lists and search engines. We chase the ones that do not act. We check every hour whether it is still online and tell you when it goes down. After that we keep watching and alert you if it comes back.
What a relay-page alert shows you
The lookalike, its certificate, and the address your login page was loaded through if the marker caught it. The evidence pack adds screenshots, who registered the domain and where it is hosted, each with the time it was captured.
No report goes to a registrar, host or blocklist until you confirm it is a live attack and type the domain to approve.
What a software group’s cloned site looked like
Case study, early 2026
Cloned website taken down
A copied-website case, not a relay one. Weeks after an acquisition was announced, someone registered a European software group’s exact name on a different domain ending and put up a near-identical copy of its website. A relay page starts the same way: a name like yours, a certificate for it and a copy of your page.
Read the case study- Weeks after an acquisition was announcedIts exact name registered on another ending, with a near-identical copy of the site
- Flagged at registration; the certificate was matched within seconds of being logged
- One-click takedown: the evidence went to ten places
- Offline before any customer was known to use it
From the case. Names changed.
Questions security teams ask
See what we would find for your domains
In a 30-minute demo we show you the lookalikes of your domain that exist today and how the website marker works on a login page.
- Which lookalikes of your domain exist now, and which have a certificate
- How the website marker goes on your login page, if you want it
- A clear annual price for your domains
A relay page already live? Report a live attack