[Bug]: Significant increase in False Positives (July 2026)

[sid351]

Required confirmations before submitting

• I can reproduce this issue on the latest released version of Check.
• I have searched existing issues (both open and closed) to avoid duplicates.
• I am not requesting general support; this is an actual bug report.

Issue Description

There's been an increase this week in Check detecting false positives.

On 2026-07-06 we had "https://id.trimble.com/": Form action "https://id.trimble.com" does not contain login.microsoftonline.com.

Today (2026-07-08) we had the following:

• "https://signin.ebay.co.uk": Form action "https://signin.ebay.co.uk/signin/s" does not contain login.microsoftonline.com
• "https://auth.services.adobe.com": Form action "https://auth.services.adobe.com/en_GB/index..." does not contain login.microsoftonline.com, with this "Phishing Indicators Found: Parse error - check browser console"
• a "Suspicious Microsoft 365 Login Page" banner appears in the CyberDrain Check-Chat Discord channel: https://discord.com/channels/905453405936447518/1418612449170690219 - with the Displayed Reason: SUSPICIOUS CONTENT DETECTED: Suspicious phishing indicators detected: phi_021_suspicious_url_structure, and Detected Indicators:
• url_structure: Suspicious URL structure with long random strings in path segments (before query parameters)

Extension Version

1.2.0

Rules Version

1.2.4

Relevant Logs / Stack Trace

[sid351]

DO NOT DOWNLOAD

fix_parser_logic zip

I can't seem to flag a reply, but this random ZIP file from a brand-new account is incredibly suspicious.

If it's a ligitimate script, upload it to GitHub and share a link to the GitHub page.

[KelvinTegelaar]

Deleted the comment, its an AI trying to get you to download a infected zip file.

[divality]

We have the same issue with the following urls:

• https://id[.]trimble[.]com/
• https://us.id.trimble.com/

[itlogic-github]

We've just had box.com blocked due to Domain Squatting as it is close to xbox.com

[AlexJamesHaines]

Just adding in for info:

• googleusercontent vs google getting flagged when opening PDF attachments in gmail.
• had britishgas get blocked as well.

[sid351]

We've had a few hits for www.googleadservices.com as well now.