[Bug]: false positiv on microsoft site

[odv-it]

Required confirmations before submitting

• I can reproduce this issue on the latest released version of Check.
• I have searched existing issues (both open and closed) to avoid duplicates.
• I am not requesting general support; this is an actual bug report.

Issue Description

https://www.xbox.com/de-DE/

Extension Version

1.1.0

Rules Version

1.1.0

Relevant Logs / Stack Trace

Block Details
URL:
https[:]//www.xbox.com/de-DE/
Category:
Critical phishing indicators detected on non-Microsoft page: phi_010_aad_fingerprint, phi_013_form_action_mismatch, phi_001_enhanced
Detection Scores
Legitimacy Score:
228.25
Threshold:
85
Threat Analysis
Indicators Found:
3
Highest Severity:
CRITICAL
Detection Method:
content-analysis
Phishing Indicators Detected
phi_010_aad_fingerprint CRITICAL
AAD-like login interface on non-Microsoft domain
phi_013_form_action_mismatch CRITICAL
Microsoft-branded password form with non-Microsoft action
phi_001_enhanced CRITICAL
Enhanced detection of domains mimicking Microsoft services with security/login keywords (excludes legitimate SSO)
Page Information
Page Title:
Offizielle Xbox-Seite: Konsolen, Spiele und Community | Xbox
User Agent:
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36 Edg/143.0.0.0
Timestamp:
26.12.2025, 12:05:16