Phishing attempt flagged by Online Threat Prevention

RodgerRabbit

I am getting the follow message every few minutes. A scan of this system and a reinstall of outlook does not fix the problem. Any ideas on how i can troubleshoot this problem.

Online Threat PreventionWe blocked this phishing page for your protection:
https://bestnogamcasino.co/
Accessed by: outlook.exe
Phishing pages attempt to obtain sensitive information such as login credentials or credit card details by disguising as trustworthy entities. The stolen data can be then used for financial gain.Add to exceptions

Alexandru_BD

Hello,

So, that notification basically indicates that Bitdefender blocked a request to a website classified as phishing and identified outlook.exe as the application making that request. This alert alone does not establish that outlook or your computer is infected. Bitdefender can also block harmful connections made by applications in the background.
And my best guess is that is what happens here.

Most probably outlook is attempting to load external content from an email, such as a linked image. An add-in is another possibility worth checking, but the notification does not identify the exact source. So this needs a bit of troubleshooting to find out what exactly triggers the detection.

I would suggest the following checks, making one change at a time:

• Check whether the alerts stop when outlook is fully closed. Exit outlook and check task manager to confirm that outlook.exe is no longer running. Wait longer than the usual interval between alerts, then reopen outlook and compare. Check the timestamps in Bitdefender’s notification history to distinguish new events from earlier ones.
• Next, block automatic downloads of external images. If you have the classic outlook, go to File → Options → Trust Center → Trust Center Settings → Automatic Download and select “Don’t download pictures automatically in HTML e-mail messages or RSS items.” Review the exceptions underneath, since these can allow downloads for certain senders. Restart outlook and observe whether the alerts continue, without manually downloading pictures in suspicious messages. If this changes the behaviour, it would point toward externally loaded message content.
• Review suspicious emails without opening their links or attachments. Pay particular attention to messages received around the time the alerts started. Delete clearly unwanted messages, including those in junk email, and empty Deleted Items after checking that nothing needed is there. This mailbox cleanup is recommended when an email client repeatedly triggers blocked-connection alerts, and if you identify the source and delete it, this will also stop the alerts. Reinstalling outlook won't solve the problem because most likely the root cause will still be there after reinstalling the app..
• Another thing you can do is test outlook in safe mode. Close outlook, press Windows + R, enter outlook.exe/safe, and press enter. Safe mode basically starts classic outlook without add-ins loaded. If the alerts stop during a comparable period of use, investigate add-ins under File → Options → Add-ins → Manage: COM Add-ins → Go. Disable them temporarily, then re-enable them individually, restarting outlook between tests, to see whether a particular add-in brings the alerts back. NOTE: This is a diagnostic test rather than confirmation that an add-in is malicious, and it's a bit more technical than the other steps. But not that difficult to do, and it may not even be necessary anymore if the previous steps solve this issue.

And this goes without saying, keep the protection enabled and DO NOT add an exception. Adding an exception would allow the connection without resolving what is causing outlook to request it, and you don't know what's there.

If the alerts persist, it may be necessary for Bitdefender Support to investigate further, but you'll have to contact them separately from this thread. Should you require their assistance, I'll leave the link here.

Let me know if anything here helped.

Regards