In a relay phishing page that reverse-proxies the real login, what does the victim's browser load?

## The shape of the thing A relay phishing page is not a clone. It is a reverse proxy standing in front of the genuine login origin. The operator registers a domain, obtains an ordinary certificate for it, and points a proxy at the real service. A victim who follows the lure connects to the operator's host over HTTPS; the proxy opens its own connection to the genuine origin, forwards the request, and returns the response. Everything the victim renders is therefore produced by the real service: the markup, the stylesheet, the tenant's own branding, the wording of the error when a password is wrong, and any further challenge the real login decides to present. There is nothing to render imperfectly, because nothing was rebuilt. ## Why TLS termination is the whole mechanism A proxy that merely relayed encrypted bytes would learn nothing. The relay works because the connection terminates at the operator's server: the victim's browser negotiates TLS with the operator's host, using the operator's certificate for the operator's name, and the operator negotiates a second, separate TLS session onward to the genuine origin. Between those two sessions the traffic is cleartext to the operator, who can read it, store it and rewrite it. Nothing here forges a certificate. The operator does not hold the genuine service's private key and does not need it, because the browser is not being asked to accept a certificate for the genuine name. It is being asked to accept a perfectly valid certificate for a name the victim did not look at closely. ## What flows, in order The victim requests the sign-in page and gets the real one. They submit an identifier; the proxy forwards it and returns whatever the service says next. They submit a password; the proxy forwards it and the service validates it for real. If the service demands a further step, the proxy relays that demand and relays the answer, and the answer is correct, because the right person is supplying it in real time to the site that asked. When the service is satisfied, it issues a session in its response, and that response passes through the proxy on its way to the victim. The operator therefore comes away with two things: the secrets typed on the way in, and the session the real service issued on the way out. A relay is a superset of a harvest page's yield, which is one reason the same operator often runs both conversions off the same lure. ## Two clocks, not one The distinction that matters at the next level is what each product's clock is. The typed password dies at the next reset. The session dies on the service's own schedule, when it expires or is otherwise ended. They are not the same good and they do not decay at the same rate, which is why an operator who converts a lure this way has produced inventory of two different kinds in a single exchange. ## What the victim could actually have checked Almost nothing in the page. Content proves nothing, because the content is genuine. The padlock proves nothing, because the certificate is genuine for the operator's domain. The victim's experience is a completely normal, completely successful sign-in, ending on the real service. What differs is the origin: the hostname in the address bar, and consequently the behaviour of anything in the browser that is tied to origin rather than appearance, such as a saved password not offering itself for an unfamiliar name. This is the reason the mechanism is described as attacker-in-the-middle rather than as a lookalike page. The lookalike part is the domain, not the site. ## Operational consequence for the operator A relay must be running at the moment the victim signs in. Its product is manufactured during a live exchange with the real service, so the proxy has to be reachable, the victim has to complete the flow, and the captured session has to be used inside its own lifetime. A harvest page has none of these constraints: it writes a form submission down and works whether anything else is up or not. That difference in operating posture is the practical reason the two conversions coexist rather than one replacing the other.