F/P for domain

[Bob916]

Hello,

Browser plugin is reporting webmail.kovars.com as scam activity.  This is a valid Exchange/OWA website (patched!). Can you please look into this. Thank you.

 

[Porthos]

Do you get the block before you log in or after. I do not see a block on the login page on any browser.

Could you be sure to check for updates.

@gonzo

 

Edited March 7, 2021 by Porthos

[Bob916]

Yes, I believe it's after I login. I'm running 

Version

2.2.20

[Porthos]

39 minutes ago, Bob916 said:

Yes, I believe it's after I login. I'm running 

Version

2.2.20

So it is when you enter your user and password and click sign in?

 

[Bob916]

Yes. 

[gonzo]

Since it occurs after authentication has been done, I cannot verify a cause.  Can you tell me if there is typically audio or video that launches on the site at the time that you are now encountering a failure?

[Bob916]

It's a typical owa webmail interface. No audio/video. Could it be picking up subject lines of the emails and recognizing a pattern that thinks it's phishing/scam (typical for email these days, but we have a spam filtering service that takes care of most of it).

[gonzo]

Doubtful.  If you can send me a debug log, I will take a look.  It is likely huge, so please reproduce the error and then get the log so that I know to look towards the bottom of the file.

[Bob916]

I whitelisted the domain in the extension and for the life of me I can't find where to remove that now to reproduce!

 

[gonzo]

Look for the kebab menu (three vertical dots) in the Browser Guard interface, then select ALLOW LIST.

[Bob916]

Ok, whitelist removed. It reports it's OK now!  Ibuse this site regularly, if it happens again I'll get you info.

 

 

[Bob916]

Hey Gonza,

This issue started happening again for this owa website. And I have the domain whitelisted. It's reproducible and occurs every time whenever owa pops up a calendar notification. What's also odd is the debug log says the url isn't whitelisted, but when I go into my whitelist it already says it is. There is some other interesting stuff in the debug log as well that doesn't make sense as it is identifying a different domain that is linked or something to the webmail domain, but it is not related to it and hosted someplace else. I would prefer to send the debug log to you direct as I do not want it in the public area. Message me as to how you would like me do that. thx

[gonzo]

The JSONL debug log will be in your \Downloads folder.  Zip it up and send it to me in a private message.  That file will likely be tiny compared to the original.  Also, because everything since Noah getting his new boat delivered is in that log, please tell me an approximate time that I should focus my observations on.

[gonzo]

The site has been whitelisted. Please allow 15-30 minutes for changes to take effect.

It was audio.  Your email plays notify.wav, or tries to until we mercilessly force it into the ethers.  Should be good now.