Phishing Investigation / Captured Portal

Captured destination

This is a saved representation of the page linked in M02. Inspect the address and the requested information; there are no working input fields.

P01 · Address shown in captured browser

https://login.northbridge-robotics.example.travel-check.example/verify

Northbridge Robotics · Employee services

Travel Access Verification

Complete before 5:00 p.m. to keep your remote access active.

Work email address

Work password

Current six-digit authenticator code

[ Verify access ] — inactive captured button

“Secure connection · Employee protection service”

Examine the request

Compare this address with the directory. Which part of the address is the host? Which trailing domain is it under? What could happen if Alex gave this page a password and a current authenticator code?

A page can copy a company name and use an encrypted connection while still requesting information for a deceptive purpose.