Another False Positive for SafeWeb

[nicbakker]

I work with a client on a Shopify site - lyferbrand - which is again being flagged with a warning.

However Norton are not identify the reason for the warning. Which make is impossible to find the reason for the flag.

Checked on Securi, VirusTotal and Google Safe Web Transparency Support: which all show the site is safe. This is the second time the site has been flagged with a false positive.I submitted a similar post on this community site in March 2026.

/t/client-website-blocked-listed-as-dangerous-despite-websafe-saying-its-safe/513644

Given it’s the second instance, I need to find out what specifically has triggered this. What is the best way to contact Norton and get specifics details?

Thanks community. Regards, Nic.

[bjm]

https://lyferbrand.com/

Threat name: URL:Blacklist
URL: lyferbrand.com
Detected by: Web Shield | URL scanning
Alert ID: 75b07050d9f4

96e495900140/2026-06-15T01:33:19.983Z

96e495900140/2026-06-15T01:33:19.983Z

Note: after submitting dispute and waiting 48 business hours with no change.
Contact official Norton Support and advise support that you’ve submitted dispute and waited 48 business hours. My understanding is…once you state that you have already submitted False Positive over the submission portal and waited 48 business hours…support agent shall take the URL and detection screenshot and advance the case.

Norton Submission Portal is used for submitting false positive reports.
Verified site owners generally have access to a dashboard where they can see the status of their site and any pending disputes.
If the status of your site has not changed – on the Safe Web public lookup – after 48 business hours – contact official Norton Support directly. Explicitly tell the agent: “I have already submitted a site dispute via the Safe Web portal more than 48 hours ago and have not received a status update.” This often prompts support to escalate the ticket manually.

Norton Submission Portal does not send automated confirmation or status update emails, even when an email address is provided.
If the review determines the detection was indeed a false positive, Norton typically releases updated definitions to address it within 48 hours without specifically notifying the submitter.

[bjm]

HTML:Script-inf [Susp] is a Norton detection name that generally indicates Norton found suspicious script content embedded in a web page and flagged it heuristically rather than identifying a known, specific malware family.

Breaking down the name:

• HTML = The threat was detected in web page content (HTML or associated script content).
• Script = JavaScript or other active web scripting was involved.
• inf = Historically short for “infection” or “infected content” in Symantec/Norton naming conventions.
• [Susp] = Suspicious. This is the important part. It usually means a heuristic or reputation-based detection rather than a signature match to known malware.

In practice, Norton may use HTML:Script-inf [Susp] when it sees things such as:

• Obfuscated JavaScript.
• Heavily packed or encoded scripts.
• Redirect chains commonly associated with scams or malicious sites.
• Scripts attempting browser exploitation techniques.
• Suspicious injected code on an otherwise legitimate site.
• Script patterns that resemble malware delivery mechanisms.

Because it is a [Susp] detection:

• It does not automatically mean the site is malicious.
• It often warrants additional investigation.
• False positives are possible, especially on sites using aggressive advertising, tracking scripts, URL shorteners, or heavily obfuscated legitimate code.

The Norton detection HTML:Script-inf [Susp] generally indicates that Norton observed web page script content that it considered suspicious based on heuristic analysis. The detection name itself does not identify the specific script or exact cause.

This type of detection can be triggered by a variety of factors, including obfuscated JavaScript, injected third-party content, redirect behavior, advertising or tracking scripts, or other script patterns that resemble known malicious activity.

As a site owner, you may want to:

• Review any recent changes to site content or themes.
• Check third-party scripts, advertising networks, tag managers, and analytics integrations.
• Scan the site for unauthorized modifications or injected code.
• Review results from independent website scanners and security tools.

[nicbakker]

Thanks so much. I am a digital producer assisting with the website. I have notified the owners, and have shared this post with them.

We have already reviewed the theme and some of the third party apps, and will seek to clean up anything we think might trigger the warning.

In the meantime, I will monitor the site to check if the false positive warning is removed.
Thanks for looking into this.

Regards, Nic.

[bjm]

We resolved the domain lyferbrand.com to IP address 23.227.38.66
IP Abuse Reports for 23.227.38.66
This IP address has been reported a total of 2 times from 2 distinct sources. 23.227.38.66 was first reported on March 25th 2026, and the most recent report was 3 weeks ago.
Old Reports: The most recent abuse report for this IP address is from 3 weeks ago . It is possible that this IP is no longer involved in abusive activities.

The domain resolves to a shared hosting IP used by Shopify. VirusTotal’s observation that the IP address has communicated with detected files may reflect activity associated with other domains hosted on the same infrastructure rather than this specific website.
The hosting IP has associations with detected files in VirusTotal telemetry. Since the IP is shared by many sites, those associations cannot be attributed to lyferbrand.com without additional evidence.

[Selvakumar.S]

Hi @nicbakker

Thank You for reporting the issue on Norton Community. The reported url is now resolved as False Positive. Could you please check now?

Thanks !

[nicbakker]

Thank you, I have checked and the site is loading.
I can see SafeWeb also lists the site as safe.

This is the second time the site has been flagged with a false positive. Is there anything we can do to avoid this in future?

Thank you for looking into this.

Regards, Nic