[Bug]: Multiple False Positives #138

Required confirmations before submitting

• I can reproduce this issue on the latest released version of Check.
• I have searched existing issues (both open and closed) to avoid duplicates.
• I am not requesting general support; this is an actual bug report.

Issue Description

Security Review Request: Possible Clean/Safe Page
Page URL: https://simplifile.ice.com/sf/ui/submitter/packages
Hostname: simplifile.ice.com
Timestamp (UTC): 2026-04-07T16:11:58.699Z
Banner Title: ⚠️ Suspicious Domain Detected
Displayed Reason: This website's domain looks similar to "live.com" but is NOT the legitimate site. Be careful entering any credentials.
Detection Score: N/A
Detected Indicators:
Domain squatting techniques detected:
levenshtein: Domain differs by 2 character(s) from protected domain

Security Alert: Website Access Blocked
Blocked URL: https[:]//CLIENTDOMAIN.account.box.com/login?redirect_url=%2Ffolder%2F34505…
Timestamp: 4/7/2026, 11:18:20 AM
Block Reason: Domain Squatting: This site closely resembles "xbox.com" but is not the legitimate site
Phishing Indicators Found:
This automated report was generated when a user attempted to access the above URL and was blocked by the security system. Please review the details to determine if this was a legitimate block or if the URL should be added to an allow list.

Security Review Request: Possible Clean/Safe Page
Page URL: [https://evalue.internationaldelivers.com/webipc/ipc/en/blank.html]
Hostname: evalue.internationaldelivers.com
Timestamp (UTC): 2026-04-07T16:06:31.374Z
Banner Title: ⚠️ Suspicious Domain Detected
Displayed Reason: This website's domain looks similar to "live.com" but is NOT the legitimate site. Be careful entering any credentials.
Detection Score: N/A
Detected Indicators:
Domain squatting techniques detected:
combosquat: Domain adds prefix/suffix to protected domain

Extension Version

1.1.0

Rules Version

1.0.8

Relevant Logs / Stack Trace