Repository navigation
[Bug]: Significant increase in False Positives (July 2026) #167
Description
Required confirmations before submitting
- I can reproduce this issue on the latest released version of Check.
- I have searched existing issues (both open and closed) to avoid duplicates.
- I am not requesting general support; this is an actual bug report.
Issue Description
There's been an increase this week in Check detecting false positives.
On 2026-07-06 we had "https://id.trimble.com/": Form action "https://id.trimble.com" does not contain login.microsoftonline.com.
Today (2026-07-08) we had the following:
- "https://signin.ebay.co.uk": Form action "https://signin.ebay.co.uk/signin/s" does not contain login.microsoftonline.com
- "https://auth.services.adobe.com": Form action "https://auth.services.adobe.com/en_GB/index..." does not contain login.microsoftonline.com, with this "Phishing Indicators Found: Parse error - check browser console"
- a "Suspicious Microsoft 365 Login Page" banner appears in the CyberDrain Check-Chat Discord channel: https://discord.com/channels/905453405936447518/1418612449170690219 - with the Displayed Reason: SUSPICIOUS CONTENT DETECTED: Suspicious phishing indicators detected: phi_021_suspicious_url_structure, and Detected Indicators:
- url_structure: Suspicious URL structure with long random strings in path segments (before query parameters)
Extension Version
1.2.0
Rules Version
1.2.4
Relevant Logs / Stack Trace
Activity
sid351 commentedon Jul 8, 2026
DO NOT DOWNLOAD
I can't seem to flag a reply, but this random ZIP file from a brand-new account is incredibly suspicious.
If it's a ligitimate script, upload it to GitHub and share a link to the GitHub page.
KelvinTegelaar commentedon Jul 8, 2026
Deleted the comment, its an AI trying to get you to download a infected zip file.
divality commentedon Jul 9, 2026
We have the same issue with the following urls:
itlogic-github commentedon Aug 18, 2026
We've just had box.com blocked due to Domain Squatting as it is close to xbox.com
AlexJamesHaines commentedon Aug 18, 2026
Just adding in for info:
• googleusercontent vs google getting flagged when opening PDF attachments in gmail.
• had britishgas get blocked as well.
sid351 commentedon Aug 24, 2026
We've had a few hits for www.googleadservices.com as well now.
readmanr commentedon Oct 14, 2026
I assume since this is a few months old it is unattended...
https://payments.guildsolutions.com.au/welcome
As you press login. id.guild.org.au
Block Details
URL:
https[:]//id.guild.org.au/e2a32909-e420-4f92-90bc-19e37668cd17/oauth2/v2.0/au...
Category:
Low legitimacy score: 17/85, phishing indicators: 1
phi_021_suspicious_url_structure
When a page tries to use their subdomain as ID.xxx for logins, I don't see how that's phishing.
Remove-Item "HKLM:\SOFTWARE\Policies\Google\Chrome\ExtensionSettings\benimdeioplgkhanklclahllklceahbe" -Recurse -Force