You should hunt for the MFA-Themed Domains referenced in Palo Alto’s repo:
FQDN - FIRST DATE OBSERVED:
mfaoptions[.]com - 8/26/26
mfa-options[.]com - 8/26/26
mfaregister[.]com - 8/27/26
register-mfa[.]com - 8/27/26
and this one too:
mfa-register[.]com - 8/27/26
#cybersecurity