What is a relay sign-in page?

What does relay sign-in page mean?

The page relays credentials and MFA responses to the legitimate identity provider, providing the actor with an authenticated session

Security teams call it an adversary in the middle. The page is not a fake that stores a password for later. It stands between the person and the real service, so a code sent by text message or approved in an app is relayed the moment it is entered.

That is why a second sign-in step by code does not stop it. A passkey or a security key does, because it is tied to the real site's address and will not answer a page on another name.

The relay page sits on a lure domain. It is shown only to people sent the link. Its name changes as the lure domains rotate, so a blocklist is a step behind.

Where does it show up in a reading?

In a LeakTrace reading it is read under “Names made from yours for fake sign-in pages”: the sign-in words attackers use (sso, mfa, enroll, activate, passkey and helpdesk) joined to your firm's name.

The page itself is not read. A name joined from the firm's name and a sign-in word is, since it is registered before the call. Many relay pages carry no firm name and cannot be seen from outside.

Which pages use this term?

• Lure domain
• Passkey
• Business email compromise