Credential Harvesting: The Lookalike Login

Start with the concept before touching the logs. Adversary-in-the-middle phishing proxies a real sign-in, captures what the victim types and what the identity provider issues afterwards, then lets the attacker act as an already-authenticated user. Read the setup, then work the steps in order.

Two messages reached alicia.rodriguez that morning, alongside the ordinary traffic of a working day. Work the email gateway and DNS records below and name the lookalike domain that stood in for a legitimate Microsoft sign-in page.

Alicia's browser did not stop at the first host it was sent to. Work the network records from her workstation and identify the external server that served the credential form and received what she typed into it.

One victim is rarely the whole campaign. Widen the search across the environment for the same pattern aimed at somebody else, and name the second domain this actor used.

The link in the message did not point at the fake login page. Reconstruct the path the browser actually walked and name the host that stood between the click and the lookalike domain.

Infrastructure alone does not prove a compromise. Read the Azure AD sign-in records for alicia.rodriguez, establish whether the stolen material was actually used, and identify what the attacker's machine reported about itself when it was.

Close the case. Weigh what the evidence actually established against the five actions available to you, and choose the one to take first.