https://salesforce.growwithimg.com/s/login/

Impersonating Salesforce

Intent: Credential collection

• Domain is not operated by Salesforce
• DNS nameservers do not match Salesforce's known infrastructure
• TLS certificate has no organization information
• Domain not registered through Salesforce's usual registrar

Login page prompting users to enter credentials to access Salesforce-related services