I am using the default "Telephone" dialer and I don't have any other installed. The "Default caller ID and spam app" setting is set to axet call recorder (which has call recording disabled).
Today I received a phone call and as it was ringing, a popup showed a warning that the call was probably spam. After a few seconds the caller disconnected before I really had a chance to read the popup. I didn't think to try to screenshot it. Afterwards, I went to a "who called" website in my browser and checked the number and it has indeed been reported as a scammer.
As far as I know, neither the default dialer nor axet includes any call screening like this. The notifications log just shows a missed call.
How do I find what generated the popup?