SOHO Hijack - SSL Stripping Indicator (Port 80 Fallback)

Ibrahim Saud@tektrix

•updated Jun 21, 2026•0•0•1

Detects web browsers connecting via Port 80 (HTTP) to domains that strictly mandate HTTPS (HSTS bypass), revealing SSL stripping via DNS hijack. Specifically targets 'login.microsoftonline.com' and 'okta.com'.