I'm running into a head scratcher type of situation. I have a user who has reported that they are getting a Windows Security pop up from outlook that keeps showing up even after clicking Cancel or signing out/in to Outlook.
Luckily, the user didn't put in their credentials.
Below are some things I've checked from a security standpoint:
- Checked the URL in the image using an analysis tool. Nothing malicious came back.
- Checked the URL "http://cdn.goalline.ca" it redirects to "https://stacksports.goalline.ca/". Nothing malicious there as well.
- Checked the domain cdn.goalline.ca and nothing malicious. Appears to be registered 20yrs ago and lines up with the stacksports site stating that it was founded in 2002.
- Checked enterprise AV, MS Defender and nothing malicious comes back.
Can anyone help in why this keeps popping up for the user? Also, how do we stop this from re-occurring?