Page asks for credentials

The checker fetches the page without executing scripts and parses the HTML for <input type="password">, the enclosing form's action and whether it posts to a different domain or to a bare endpoint such as post.php on the same throwaway host, hidden fields, an email address pre-filled from the URL fragment (#[email protected], a common kit feature), a <title> naming a brand that is not the domain's owner, and logos hot-linked from a brand's own CDN. Medium alone; combined with a lookalike, a young domain or a brand in the subdomain, it becomes high. Limits: many kits build the form with JavaScript after load, so "no form found" does not mean none exists; legitimate login pages obviously have password fields. This check multiplies the other signals; it is not proof by itself.

Credential harvesting is the purpose of most phishing. Kits reproduce Microsoft 365, Google and bank sign-in pages exactly, and adversary-in-the-middle kits such as EvilProxy go further: they proxy the real site live, capture the password and the session cookie, and thereby defeat SMS and app-based two-factor codes. Corporate Microsoft 365 users are the most targeted group because one mailbox opens the door to invoice fraud against the whole company.

Never sign in from a link in a message; open the service from a bookmark or by typing the address. Use a password manager, which fills only on the real domain, and passkeys or a FIDO2 security key, which are bound to the origin and cannot be proxied. If you did enter credentials: change the password immediately from a device you trust, sign out of all sessions, check the mailbox for forwarding rules the attacker may have added, and enable two-factor authentication. Related: plain HTTP. Guides: how to spot phishing, two-factor authentication and what to do after a compromise.