I have a user who has reported that they are getting a Windows Security pop up from Outlook that keeps showing up even after clicking Cancel and signing out/in shown below
Luckily, the user didn't put in their credentials.
Below are some things I've checked from a security standpoint:
- Checked the URL in the image using an analysis tool. Nothing malicious came back.
- Checked the URL
http://cdn.goalline.cait redirects to
https://stacksports.goalline.ca/. Nothing malicious there as well.
- Checked the domain cdn.goalline.ca and nothing malicious. Appears to be registered 20yrs ago and lines up with the stacksports site stating that it was founded in 2002.
- Checked enterprise AV, MS Defender, etc. and nothing malicious comes back.
- Checked list of applications and there were no recent installs or any programs that point to the URLs.
From a security perspective, it seems that there's nothing malicious. Is there anything else I'm potentially missing/need to check?
Also, how can I stop the pop up from re-occurring?