[Bug]: https://helpdesk.kaseya.com/ new ticket being blocked

[ln-sec]

Required confirmations before submitting

• I can reproduce this issue on the latest released version of Check.
• I have searched existing issues (both open and closed) to avoid duplicates.
• I am not requesting general support; this is an actual bug report.

Issue Description

I received this error when trying to submit a ticket to the Kaseya helpdesk, logged in through M365 SSO:

URL:
https[:]//helpdesk.kaseya.com/hc/en-gb/requests/new?ticket_form_id=360001361458
Category:
Critical phishing indicators detected on non-Microsoft page: phi_001_enhanced

Page Title:
Submit a request – Kaseya
User Agent:
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36
Timestamp:
30-9-2025, 11:54:48

Extension Version

1.0.5

Rules Version

1.0.6

Relevant Logs / Stack Trace

[ln-sec]

Seems resolved after recreating the ticket.

[Ben-ITLogic]

I am also seeing the same issue. Seems to take 2-3 minutes to process everything and then it triggers. Can you please re-open so I can add more details?

[nichxlxs]

Seems to be multiple detection rules regexes picking up buzz words in the page content. Just takes a while for the extension to scan it since it's a huge page.

Page source is viewable here: view-source:https://helpdesk.kaseya.com/hc/en-gb/requests/new?ticket_form_id=360001361458

A lot of the issues and false positives I can see originate from the 'ZendeskThemeAssets' variable in the in-line script.

For example, phi_004:

phi_001_enhanced:

[ln-sec]

@Ben-ITLogic done!

[KelvinTegelaar]

Please test this in our latest version. v1.0.7 is being released today. :)