A finance employee reports that after clicking a link in an internal-looking email, they entered credentials on a portal at 'micorsoft-login.com'. The company normally uses 'microsoft.com' services. The IT security team confirms the fraudulent site is nearly identical to the legitimate Microsoft login page. Which threat vector BEST describes the technique used to register the malicious domain?