[Bug]: False Positive

[kmcclain-entre]

Required confirmations before submitting

• I can reproduce this issue on the latest released version of Check.
• I have searched existing issues (both open and closed) to avoid duplicates.
• I am not requesting general support; this is an actual bug report.

Issue Description

URL: https[:]//www.xbox.com/en-US/?msockid=0aaa880b24ef62971f769ee025d46315
Category: Critical phishing indicators detected on non-Microsoft page: phi_010_aad_fingerprint, phi_013_form_action_mismatch, phi_001_enhanced

Extension Version

1.1.0

Rules Version

1.1.0

Relevant Logs / Stack Trace

{
  "securityEvents": [
    {
      "event": {
        "action": "blocked",
        "clientId": null,
        "clientReason": null,
        "clientSuspicious": false,
        "phishingIndicators": [
          "phi_031_suspicious_query_length_combined",
          "phi_033_suspicious_event_listeners",
          "phi_004",
          "phi_012_suspicious_resources",
          "phi_006",
          "phi_010_aad_fingerprint",
          "phi_013_form_action_mismatch",
          "phi_014_devtools_blocking",
          "phi_015_code_obfuscation",
          "phi_001_enhanced",
          "phi_002",
          "phi_003",
          "phi_020_grammar_typos",
          "phi_017_microsoft_brand_abuse",
          "phi_023_css_selection_blocking",
          "phi_029_fake_dead_links",
          "phi_030_empty_tag_obfuscation"
        ],
        "protectionEnabled": true,
        "reason": "Critical phishing indicators detected on non-Microsoft page: phi_010_aad_fingerprint, phi_013_form_action_mismatch, phi_001_enhanced",
        "redirectTo": null,
        "severity": "critical",
        "threatDetected": true,
        "threatLevel": "critical",
        "timestamp": "2026-02-13T20:28:36.881Z",
        "type": "threat_blocked",
        "url": "https[:]//mircosftonlinelin.mldlands.net/?B3MZK=0bG2oOE&DY8wHn=d786e3a907bc4f4bafea079e523e1503",
        "userAgent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36 Edg/144.0.0.0"
      },
      "profile": {
        "browserInfo": {
          "browserType": "edge",
          "browserVersion": "144.0.0.0",
          "extensionId": "knepjpocdagponkonnbggpcnhnaikajg",
          "installType": "admin",
          "language": "en-US",
          "platform": "Win32",
          "version": "1.1.0"
        },
        "isManaged": true,
        "profileId": "72d3e551-0f93-4f88-b639-fc586535ac7c",
        "timestamp": "2026-02-13T20:28:06.310Z",
        "userInfo": {
          "accountType": "work-school",
          "email": "kmcclain@entremt.com",
          "emailNotAvailable": false,
          "id": "04b51d83-3d55-4c9d-9229-3436560fa957",
          "provider": "unknown",
          "reason": null
        }
      },
      "tabId": 291980504,
      "timestamp": "2026-02-13T20:28:36.898Z",
      "type": "security_event"
    },
    {
      "event": {
        "action": "blocked",
        "clientId": null,
        "clientReason": null,
        "clientSuspicious": false,
        "phishingIndicators": [
          "phi_031_suspicious_query_length_combined",
          "phi_033_suspicious_event_listeners",
          "phi_004",
          "phi_012_suspicious_resources",
          "phi_006",
          "phi_010_aad_fingerprint",
          "phi_013_form_action_mismatch",
          "phi_014_devtools_blocking",
          "phi_015_code_obfuscation",
          "phi_001_enhanced",
          "phi_002",
          "phi_003",
          "phi_020_grammar_typos",
          "phi_017_microsoft_brand_abuse",
          "phi_023_css_selection_blocking",
          "phi_029_fake_dead_links",
          "phi_030_empty_tag_obfuscation"
        ],
        "protectionEnabled": true,
        "reason": "Critical phishing indicators detected on non-Microsoft page: phi_010_aad_fingerprint, phi_013_form_action_mismatch, phi_001_enhanced",
        "redirectTo": null,
        "severity": "critical",
        "threatDetected": true,
        "threatLevel": "critical",
        "timestamp": "2026-02-13T20:30:54.344Z",
        "type": "threat_blocked",
        "url": "https[:]//mircosftonlinelin.mldlands.net/?B3MZK=0bG2oOE&DY8wHn=8aab16d2c0604dc78cab0f4cb8c0aa97",
        "userAgent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36 Edg/144.0.0.0"
      },
      "profile": {
        "browserInfo": {
          "browserType": "edge",
          "browserVersion": "144.0.0.0",
          "extensionId": "knepjpocdagponkonnbggpcnhnaikajg",
          "installType": "admin",
          "language": "en-US",
          "platform": "Win32",
          "version": "1.1.0"
        },
        "isManaged": true,
        "profileId": "72d3e551-0f93-4f88-b639-fc586535ac7c",
        "timestamp": "2026-02-13T20:28:06.310Z",
        "userInfo": {
          "accountType": "work-school",
          "email": "kmcclain@entremt.com",
          "emailNotAvailable": false,
          "id": "04b51d83-3d55-4c9d-9229-3436560fa957",
          "provider": "unknown",
          "reason": null
        }
      },
      "tabId": 291980519,
      "timestamp": "2026-02-13T20:30:54.357Z",
      "type": "security_event"
    },
    {
      "event": {
        "action": "blocked",
        "clientId": null,
        "clientReason": null,
        "clientSuspicious": false,
        "phishingIndicators": [
          "phi_031_suspicious_query_length_combined",
          "phi_033_suspicious_event_listeners",
          "phi_004",
          "phi_012_suspicious_resources",
          "phi_006",
          "phi_010_aad_fingerprint",
          "phi_013_form_action_mismatch",
          "phi_014_devtools_blocking",
          "phi_015_code_obfuscation",
          "phi_001_enhanced",
          "phi_002",
          "phi_003",
          "phi_020_grammar_typos",
          "phi_017_microsoft_brand_abuse",
          "phi_023_css_selection_blocking",
          "phi_029_fake_dead_links",
          "phi_030_empty_tag_obfuscation"
        ],
        "protectionEnabled": true,
        "reason": "Critical phishing indicators detected on non-Microsoft page: phi_010_aad_fingerprint, phi_013_form_action_mismatch, phi_001_enhanced",
        "redirectTo": null,
        "severity": "critical",
        "threatDetected": true,
        "threatLevel": "critical",
        "timestamp": "2026-02-13T20:47:58.977Z",
        "type": "threat_blocked",
        "url": "https[:]//www.xbox.com/en-US/?msockid=0aaa880b24ef62971f769ee025d46315",
        "userAgent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36 Edg/144.0.0.0"
      },
      "profile": {
        "browserInfo": {
          "browserType": "edge",
          "browserVersion": "144.0.0.0",
          "extensionId": "knepjpocdagponkonnbggpcnhnaikajg",
          "installType": "admin",
          "language": "en-US",
          "platform": "Win32",
          "version": "1.1.0"
        },
        "isManaged": true,
        "profileId": "72d3e551-0f93-4f88-b639-fc586535ac7c",
        "timestamp": "2026-02-13T20:47:49.582Z",
        "userInfo": {
          "accountType": "work-school",
          "email": "kmcclain@entremt.com",
          "emailNotAvailable": false,
          "id": "04b51d83-3d55-4c9d-9229-3436560fa957",
          "provider": "unknown",
          "reason": null
        }
      },
      "tabId": 291980543,
      "timestamp": "2026-02-13T20:47:58.994Z",
      "type": "security_event"
    }
  ],
  "accessLogs": [],
  "debugLogs": [],
  "timestamp": "2026-02-13T20:50:54.997Z",
  "version": "1.1.0"
}

[KelvinTegelaar]

added to default whitelist