https://salesforce.growwithimg.com/s/login/

Impersonating Salesforce

Intent: Credential collection

• Domain is not operated by Salesforce
• DNS nameservers do not match Salesforce's known infrastructure
• TLS certificate has no organization information
• TLS certificate was issued very recently
• Domain not registered through Salesforce's usual registrar

login page prompting users to enter credentials to access Salesforce account