This page is served under my.authanvil.eu, a subdomain of the AuthAnvil EU SSO/MFA customer login portal.
The DNS record for this host CNAMEs to authanvileu.tafficmanager.net — a typo of the legitimate trafficmanager.net (Azure Traffic Manager) — which was unregistered until this demonstration.
Registering the typo domain and pointing it here demonstrates that an attacker with no access to AuthAnvil/Kaseya infrastructure can serve arbitrary content — including a convincing fake login page — on this trusted subdomain.
This page is a non-destructive proof of control only. No credentials are collected, no user data is accessed or stored.
Researcher: bugspiderlee