Google Forms lookalike page on non-Google host followed by spoofed Google login

ills3c Intel&Coffee@Ills3C

•updated 11 days ago•1•0•1

Detects web traffic where a non-Google hosted domain serves pages containing both Google Form lookalike patterns and login/sign-in lookalike paths within a short timeframe (30 minutes), indicative of a credential harvesting or phishing campaign.