https://www.sign-in-to-your-workspace-account-microsoft.com/

Impersonating Microsoft

Intent: Credential collection

• Domain is not operated by Microsoft
• TLS certificate has no organization information
• Domain was registered very recently
• Domain not registered through Microsoft's usual registrar

Microsoft sign-in page with email or username and password fields