[Bug]: phi_014_devtools_blocking - Reddit

[matthewpmorgan]

Required confirmations before submitting

• I can reproduce this issue on the latest released version of Check.
• I have searched existing issues (both open and closed) to avoid duplicates.
• I am not requesting general support; this is an actual bug report.

Issue Description

www.reddit.com phi_014_devtools_blocking

{
"event": {
"action": "detected",
"clientId": null,
"clientReason": null,
"clientSuspicious": false,
"phishingIndicators": [
"phi_014_devtools_blocking"
],
"protectionEnabled": true,
"reason": "Suspicious phishing indicators detected: phi_014_devtools_blocking",
"redirectTo": null,
"severity": "medium",
"threatDetected": true,
"threatLevel": "medium",
"timestamp": "2025-09-22T13:53:21.641Z",
"type": "threat_detected_no_action",
"url": "https[:]//www.reddit.com/",
"userAgent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36 Edg/140.0.0.0"
},
"profile": {
"browserInfo": {
"browserType": "edge",
"browserVersion": "140.0.0.0",
"extensionId": "knepjpocdagponkonnbggpcnhnaikajg",
"installType": "admin",
"language": "en-GB",
"platform": "Win32",
"version": "1.0.4"
},
"isManaged": true,
"profileId": "x",
"timestamp": "2025-09-22T13:53:16.946Z",
"userInfo": {
"accountType": "work-school",
"email": "x@x.uk",
"emailNotAvailable": false,
"id": "x",
"provider": "unknown",
"reason": null
}
},
"tabId": 2097150444,
"timestamp": "2025-09-22T13:53:21.642Z",
"type": "security_event",
"category": "security"
}

Extension Version

1.0.4

Rules Version

1.0.0

Relevant Logs / Stack Trace

[effse7en]

I see similar errors periodically, usually when I leave a tab open then go to lunch and come back.

{
  "event": {
    "action": "detected",
    "clientId": null,
    "clientReason": null,
    "clientSuspicious": false,
    "phishingIndicators": [
      "phi_014_devtools_blocking",
      "phi_003",
      "phi_017_microsoft_brand_abuse"
    ],
    "protectionEnabled": true,
    "reason": "Suspicious phishing indicators detected: phi_014_devtools_blocking, phi_003, phi_017_microsoft_brand_abuse",
    "redirectTo": null,
    "severity": "medium",
    "threatDetected": true,
    "threatLevel": "medium",
    "timestamp": "2025-09-22T15:14:02.408Z",
    "type": "threat_detected_no_action",
    "url": "https[:]//www.reddit.com/",
    "userAgent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36 Edg/140.0.0.0"
  },
  "profile": {
    "browserInfo": {
      "browserType": "edge",
      "browserVersion": "140.0.0.0",
      "extensionId": "knepjpocdagponkonnbggpcnhnaikajg",
      "installType": "normal",
      "language": "en-US",
      "platform": "Win32",
      "version": "1.0.4"
    },
    "isManaged": false,
    "profileId": "x",
    "timestamp": "2025-09-22T15:13:27.962Z",
    "userInfo": {x}
  },
  "tabId": 1320061574,
  "timestamp": "2025-09-22T15:14:02.410Z",
  "type": "security_event"
},
{
  "event": {
    "action": "detected",
    "clientId": null,
    "clientReason": null,
    "clientSuspicious": false,
    "phishingIndicators": [
      "phi_014_devtools_blocking"
    ],
    "protectionEnabled": true,
    "reason": "Suspicious phishing indicators detected: phi_014_devtools_blocking",
    "redirectTo": null,
    "severity": "medium",
    "threatDetected": true,
    "threatLevel": "medium",
    "timestamp": "2025-09-23T17:30:50.463Z",
    "type": "threat_detected_no_action",
    "url": "https[:]//www.reddit.com/",
    "userAgent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36 Edg/140.0.0.0"
  },
  "profile": {
    "browserInfo": {
      "browserType": "edge",
      "browserVersion": "140.0.0.0",
      "extensionId": "knepjpocdagponkonnbggpcnhnaikajg",
      "installType": "normal",
      "language": "en-US",
      "platform": "Win32",
      "version": "1.0.4"
    },
    "isManaged": false,
    "profileId": "x",
    "timestamp": "2025-09-23T17:30:51.001Z",
    "userInfo": {x}
  },
  "tabId": 1320062300,
  "timestamp": "2025-09-23T17:30:51.008Z",
  "type": "security_event"
}

[renada-jacob]

I am getting similar problems on HaloPSA instances:

{
  "event": {
    "action": "detected",
    "clientId": null,
    "clientReason": null,
    "clientSuspicious": false,
    "phishingIndicators": [
      "phi_004",
      "phi_006",
      "phi_014_devtools_blocking",
      "phi_003"
    ],
    "protectionEnabled": true,
    "reason": "Suspicious phishing indicators detected: phi_004, phi_006, phi_014_devtools_blocking, phi_003",
    "redirectTo": null,
    "severity": "medium",
    "threatDetected": true,
    "threatLevel": "medium",
    "timestamp": "2025-09-23T13:20:19.659Z",
    "type": "threat_detected_no_action",
    "url": "https[:]//{HALO_URL}/config/integrations/customintegrations/runbooks?id=d525d684-137e-4353-886a-e6368a1c44d8",
    "userAgent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36 Edg/140.0.0.0"
  },
  "profile": {
    "browserInfo": {
      "browserType": "edge",
      "browserVersion": "140.0.0.0",
      "extensionId": "knepjpocdagponkonnbggpcnhnaikajg",
      "installType": "normal",
      "language": "en-GB",
      "platform": "Win32",
      "version": "1.0.4"
    },
    "isManaged": false,
    "profileId": "d06f2f23-4149-49a6-b747-12ef422a893f",
    "timestamp": "2025-09-23T13:20:17.958Z"
  },
  "tabId": 1607134790,
  "timestamp": "2025-09-23T13:20:19.660Z",
  "type": "security_event",
  "category": "security"
}

REDACTED: UserInfo + Halo URL..

[ChanceGardener]

Got this happening on our Meraki dashboard also; happened while in the VPN settings doing nothing of note. Redacted user info + customer info.

{
  "event": {
    "action": "blocked",
    "clientId": null,
    "clientReason": null,
    "clientSuspicious": false,
    "escalated": true,
    "escalationReason": "3 warning threats exceeded threshold of 3",
    "phishingIndicators": [
      "phi_004",
      "phi_014_devtools_blocking",
      "phi_003"
    ],
    "protectionEnabled": true,
    "reason": "Multiple phishing indicators detected on non-Microsoft page (3/3 threshold exceeded): phi_004, phi_014_devtools_blocking, phi_003",
    "redirectTo": null,
    "severity": "critical",
    "threatDetected": true,
    "threatLevel": "critical",
    "timestamp": "2025-11-03T16:11:03.483Z",
    "type": "threat_blocked",
    "url": "https[:]//n1124.dashboard.meraki.com/{customer}/n/vK_DybDb/manage/configure/client_vpn_settings?from=security_sd_wan+client_vpn",
    "userAgent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/141.0.0.0 Safari/537.36 Edg/141.0.0.0",
    "warningThresholdCount": 3
  },
  "profile": {
    "browserInfo": {
      "browserType": "edge",
      "browserVersion": "141.0.0.0",
      "extensionId": "knepjpocdagponkonnbggpcnhnaikajg",
      "installType": "normal",
      "language": "en-US",
      "platform": "MacIntel",
      "version": "1.0.5"
    },
    "isManaged": false,
    "profileId": "f705f00f-eabb-4574-997d-e42f41df0094",
    "timestamp": "2025-11-03T16:11:04.320Z"
  },
  "tabId": 241860343,
  "timestamp": "2025-11-03T16:11:04.346Z",
  "type": "security_event",
  "category": "security"
}

[KelvinTegelaar]

Please test this in our latest version. v1.0.7 is being released today. :)