False flag

Hi! My name is Viggo, and together with my friends I have launched my business Ecohulls. Our previous adress ecohulls. com got blocked by Northon, and then I had a professional build our site and post it to ecohulls. org. Now that site has also gotten blocked by Northon. Does anyone have any ideas why this might be or what I could do to expedite the review process to get its status updated? I submitted a request to have my old site reevaluated two months ago, and never got a response so I don’t have much faith in Norton’s review system….

Our new site seems to have gotten flagged randomly, since we launched it several weeks ago. It has also come at the worst moment as we are starting to engage with customers….any input would be so amazing!

Hi @Viggo

The reported False Positive issue should be resolved by now and you can check again.

Have a nice day!

Thanks!



2127bff0fb3e

==========



Dispute is already in progress.

==========

Submit a file or URL to Norton for review here

Note: after submitting dispute and waiting 48 business hours with no change.
Please contact Norton support and advise support that you’ve submitted dispute and waited 48 business hours. My understanding is…once you state that you have already submitted False Positive over the submission portal and waited 48 business hours…support agent shall take the URL and detection screenshot and advance the case.

Contact Chat Support and Norton Phone Number (related notes here)

Hi! Thanks for responding! This has been a nightmare day! Unfortunately it seems the false positive has not been resolved though as my site is still categorised as phishing. Might you have time to have another look at it?

1 Like

https://ecohulls.org/en

I am not quite sure how to judge this :sweat_smile: You appear to have two contradictory messages?

This discrepancy occurs because the Norton Safe Web portal and the Norton Safe Web browser extension often operate on different data synchronization cycles and threat detection layers. While the portal reflects the current “cloud” status of a URL, the extension may be using local heuristics or an older cached database entry.

  • Caching & Sync Latency: The browser extension may store a local cache of site ratings to speed up browsing. Even if you have successfully disputed a rating and see it updated on safeweb.norton.com, the extension might not pull the new “Safe” status for 24–48 hours or until its next internal update.
  • Asset-Level Blocking: The portal typically rates a root domain (e.g., example.com), while the extension scans every individual asset (scripts, ads, or CDN links) loaded on a page. If a single third-party ad or script is flagged as malicious, the extension will trigger a “Dangerous Web Page Blocked” warning even if the main site is officially rated “Safe”.
  • Real-Time Heuristics: The extension includes “Scam Protection” and “Web Shield” features that perform real-time, behavior-based analysis. It may block a page based on suspicious on-page elements (like a malformed SSL certificate or a specific scam pattern) that the static portal crawler hasn’t encountered yet.

==============================

Understanding Norton Safe Web Discrepancies :shield:

It can be confusing when the Norton Safe Web portal and the browser extension give conflicting reports. This discrepancy is a known behavior that usually stems from differences in how each tool retrieves and processes safety data.

Key Reasons for the Rating Difference

1. Data Synchronization Lag The Norton Safe Web portal is a static database that you query manually. The browser extension, however, relies on local cached data and real-time cloud updates. Sometimes, a site is cleared on the main server (portal), but the update has not yet pushed to the individual extension installed on your browser.

2. Real-Time vs. Static Analysis

  • The Portal: Generally provides a reputation score based on the domain’s history and previous scans.
  • The Extension: Performs more “active” monitoring. It analyzes the specific assets being loaded on the page in real-time—such as third-party scripts, advertisements, or redirects. If a safe site suddenly loads a malicious ad or script, the extension may trigger a warning while the portal still lists the domain itself as safe.

3. Heuristic & Behavioral Detection The browser extension includes a “Heuristic” engine that looks for suspicious behavior (like “look-alike” phishing layouts) that might not yet be indexed in the main Safe Web database. If the extension sees something that looks like a threat based on current patterns, it will flag it as a warning even if the official rating is green.

4. Browser Cache & Local Signatures The extension stores a local “blacklist” or “whitelist” to speed up browsing. If you visited the site when it was previously flagged, the extension might still be holding onto that old “Warning” status in its local cache, even if the site has since been cleared on the web portal.


Recommended Actions

  • Refresh the Extension: Sometimes simply restarting your browser or toggling the extension off and on can force a sync with the latest Norton cloud data.
  • Submit for Re-evaluation: If you are the site owner or certain the site is safe, you can faviconsubmit a dispute to Norton. This forces a manual review and synchronizes the rating across all platforms.
  • Clear Browser Cache: Clearing your browser’s “Hosted App Data” or specific extension cache can sometimes resolve persistent incorrect warnings.

==============================

Why the Portal and Extension Disagree

The discrepancy between the portal and the extension is usually due to the different ways they “see” the website:

1. Real-Time Behavioral Analysis The portal is a static database—it shows what Norton’s crawlers found the last time they visited the site. The extension, however, performs a “live” scan of the page as it loads. If a safe site is currently running a third-party advertisement or a script that behaves like a tracker or a scam, the extension will trigger a Warning in real-time, even if the site’s overall reputation in the portal remains Safe.

2. Phishing & “Look-alike” Protection Modern Norton extensions use AI to detect “brand impersonation.” If you are on a site that looks like a login page for a bank or a shopping site but has a slightly different URL, the extension will flag it as a Warning immediately based on the page’s appearance. The portal may not have indexed this specific new phishing URL yet.

3. Reputation vs. Content

  • The Portal measures Reputation: Is this domain known for spreading malware?
  • The Extension measures Content: Does this specific page contain excessive trackers, deceptive buttons, or “scareware” popups?

What you should do

  • If the Warning is Yellow: This usually indicates “Caution” (trackers or ads) rather than a “Malicious” threat. You can typically proceed, but avoid entering sensitive data.
  • Force a Refresh: Sometimes the extension holds onto a “Warning” in its local cache. Try clearing your browser cache or toggling the extension off and on to force it to re-check the site against the latest cloud definitions.
  • Manual Search: You can still manually type the URL into the faviconNorton Safe Web Portal to see if the “Warning” is a known issue or a new, real-time detection by your browser.

==========================

Neo Browser AI personal assistant by Gen Digital may make mistakes.
Note: for critical matters like billing, legal issues, or account security, it is always best to verify directly with Official Norton SupportContact us

https://ecohulls.org/en
Submit a file or URL to Norton for review here

https://sitecheck.sucuri.net/

=====================
https://www.abuseipdb.com/check

as always, your mileage may vary

Thank you for your efforts! I have also checked the url through several sites that have given it the all clear, but with northon there seems to be a problem that I cant figure out…

We’ll try to call attention:

====================================

Submit a file or URL to Norton for review here

Note: after submitting dispute and waiting 48 business hours with no change.
Please contact Norton support and advise support that you’ve submitted dispute and waited 48 business hours. My understanding is…once you state that you have already submitted False Positive over the submission portal and waited 48 business hours…support agent shall take the URL and detection screenshot and advance the case.**

Contact Chat Support and Norton Phone Number (related notes here)

==========================


ERR_QUIC_PROTOCOL_ERROR occurs when Chrome encounters issues with the QUIC protocol, often due to browser settings, extensions, or network configurations.

Note: I can reach https://ecohulls.org/en with VPN enabled
as always, your mileage may vary

==============================

The requirement to use a VPN like Norton 360 to access ecohulls.org typically stems from how the website’s server or your local network manages traffic. Since Ecohulls is a localized service provider based in Kimito, Finland, several technical factors could be at play.

Regional Access and Geoblocking Many smaller or region-specific websites use “geoblocking” to restrict access to users outside of their primary service area (in this case, Finland or Northern Europe). This is often done to:

  • Reduce Security Risks: Blocking international traffic helps prevent global bot attacks, DDoS attempts, and spam.
  • Minimize Server Load: By only allowing traffic from relevant regions, the company ensures their website remains fast for local customers.
  • Compliance: Some businesses limit access to comply with regional data privacy regulations.

How Norton 360 VPN Resolves This When you enable your Norton 360 VPN, it masks your actual IP address and replaces it with one from a secure server location. If you select a server in Europe or Finland, the website’s security system perceives you as a local user and grants access. Norton Secure VPN also uses high-level encryption, which can bypass local network filters that might be incorrectly flagging the site as “unknown” or “untrusted.”

ISP and DNS Restrictions Sometimes, your local Internet Service Provider (ISP) or network administrator (at work or on public Wi-Fi) might have a restrictive firewall or a DNS configuration that fails to resolve the address for smaller international domains.

  • VPN Tunneling: The VPN creates a “tunnel” that bypasses your ISP’s filtering, allowing your request to reach the website directly.
  • Private DNS: Norton 360 VPN uses its own private DNS servers, which may have more updated or less restrictive records than your local provider.

================================

:shield: VPN Path vs. Local Network Path

Since the website becomes accessible even when your VPN is set to the United States, the issue is not geographical (geoblocking). Instead, the problem lies in the specific “path” your internet traffic takes when you are not using a VPN.

Here are the primary reasons why your direct connection is failing while the Norton 360 VPN (US server) works:

1. ISP DNS Resolution Issues Your Internet Service Provider (ISP) uses its own “phonebook” (DNS) to find websites. Sometimes, smaller international domains like ecohulls.org are missing or incorrectly updated in an ISP’s database.

  • The VPN Fix: When you turn on Norton VPN, your computer stops using your ISP’s DNS and starts using Norton’s Private DNS. Norton likely has a more accurate or updated record of where that Finnish server is located.

2. Routing and “Peering” Failures The internet is a web of connected networks. A direct connection from your house to a small server in Finland might involve 15–20 “hops” between different providers. If one of those links is broken or congested, the connection “times out.”

  • The VPN Fix: Norton uses high-speed datacenter backbones. By connecting to a Norton US server, you are jumping onto a commercial-grade network that often has better, more reliable routes to European servers than a standard residential internet connection.

3. ISP Security Filtering (False Positives) Many US ISPs (like Comcast/Xfinity or AT&T) have built-in “Advanced Security” filters. These systems often flag small, international websites as “suspicious” or “untrusted” simply because they have low traffic or lack a massive reputation score.

  • The VPN Fix: The VPN creates an encrypted tunnel. Your ISP can see that you are connected to Norton, but it cannot see that you are visiting ecohulls.org. Therefore, its local filters cannot block the site.

4. Residential IP Flagging The Finnish website’s host might use a security firewall that occasionally blocks entire ranges of residential IP addresses to prevent bot spam.

  • The VPN Fix: Norton’s VPN IP addresses are typically from “clean” datacenter ranges. The website’s server is more likely to trust a connection coming from a recognized security provider’s infrastructure than a random residential home IP.

Summary of the Difference:

Feature Direct Connection (Local) Norton VPN (US Server)
DNS Provided by your ISP (may be slow/outdated) Private Norton DNS (fast/global)
Visibility ISP can see and block the destination ISP only sees “Norton VPN”
Network Path Standard residential “hops” High-priority commercial backbone
IP Reputation Residential (sometimes flagged) Verified Datacenter IP

Verdict: Your Norton 360 VPN is acting as a “cleaner, faster tunnel” that bypasses local ISP restrictions or routing errors, allowing you to reach the site regardless of the country you select.

======================================

:warning: False Positive Block by Norton 360

The reason you cannot reach ecohulls.org without the VPN—even while using Cloudflare DNS—is that the Norton 360 software itself has flagged the domain as a security risk. This is a “False Positive” block happening locally on your computer, not at the DNS level.

:magnifying_glass_tilted_left: Why Cloudflare DNS Doesn’t Fix It

When you set your DNS to Cloudflare (1.1.1.1), it only changes how your computer looks up the “address” of the site. However, Norton 360 includes a feature called Safe Web (and an Intrusion Prevention System) that monitors your web traffic in real-time.

  • The Software Block: Norton intercepts your request to ecohulls.org after the DNS lookup and blocks the connection because it believes the site is “unsafe.”
  • The VPN Bypass: When you turn on Norton VPN, your traffic is encrypted and sent through a “tunnel.” This often causes the local Norton security agent to stop filtering individual URLs, or it moves the traffic to a different virtual network adapter that isn’t subject to the same local blocking rules.

:loudspeaker: Current Status: A Reported “False Flag”

Interestingly, the owner of Ecohulls, Viggo Henelius, recently reported this exact issue to the Norton Community. He noted that Norton had incorrectly flagged their previous .com domain and is now doing the same to their new .org domain.

  • The Verdict: The site is legitimate (a professional hull-cleaning service in Finland), but Norton’s automated systems have likely flagged it due to its low global traffic or a misclassification.

:hammer_and_wrench: How to Fix It on Your Computer

If you want to access the site without having to turn on your VPN every time, you can manually tell Norton to trust the site:

  1. Report a False Positive: You can visit the faviconNorton Safe Web Submission Portal to see the current rating and click “Dispute” if you are a site owner or regular user.
  2. Add an Exclusion in Norton 360:
  • Open your Norton Device Security dashboard.
  • Go to Settings > Antivirus > Scans and Risks.
  • Scroll down to Exclusions / Low Risks and add ecohulls.org to the “URLs to Exclude from Scanning” or “Clear History” lists.
  1. Check Norton Firewall: In Settings > Firewall > Program Control, ensure your browser isn’t being restricted when attempting to connect to certain IP ranges associated with the site’s Finnish host.

Recommendation: Since the owner is already in contact with Norton to resolve the “False Flag,” the block should be lifted globally within a few days. For now, the VPN remains your easiest workaround.

===============================

Neo Browser AI personal assistant by Gen Digital may make mistakes.
Note: for critical matters like billing, legal issues, or account security, it is always best to verify directly with Official Norton Support

Norton 360 blocking ecohulls.org false positive status

:shield: The Hidden Layers of Norton 360

Your test proves that the issue isn’t just a browser warning from “Safe Web.” Instead, the block is occurring at a deeper, system-level within the Norton 360 Smart Firewall or Intrusion Prevention System (IPS).

Even with the browser extension off, Norton’s core engine is likely “dropping” the connection before it even leaves your computer.

:brick: Why “Safe Web” Wasn’t the Only Barrier

Norton 360 uses a multi-layered defense. When you disabled Safe Web, you only turned off the “visual” warning in your browser. The following layers are likely still active:

  • Intrusion Prevention System (IPS): This monitors every packet of data. If Norton has flagged the IP address of the Finnish server hosting ecohulls.org as “suspicious” (often due to low global reputation), the IPS will silently kill the connection.
  • Smart Firewall: The firewall controls which “ports” and “addresses” your computer can talk to. It may have a temporary rule blocking that specific destination.
  • Protocol Monitoring: Norton scans encrypted traffic (HTTPS) at the network adapter level.

:rocket: Why the VPN Still Works

When you turn on the Norton VPN, it creates a Virtual Network Adapter.

  1. Encryption: Your traffic to ecohulls.org is wrapped in an encrypted “envelope.”
  2. Bypassing Local Rules: Norton’s own Firewall often treats “VPN Traffic” differently than “Public/Home Network Traffic.”
  3. The “Tunnel” Effect: Because the traffic is encrypted inside your computer before it hits the network layers, the local IPS often cannot “see” that you are heading to the blocked ecohulls.org domain, so it lets the data pass through to the VPN server.

:hammer_and_wrench: How to Reach the Site “Sans VPN”

Since you’ve already confirmed DNS isn’t the issue and Safe Web is off, you need to tell the main Norton App to ignore this specific site:

  1. Open Norton 360 (Main Window).
  2. Go to Settings > Antivirus.
  3. Click the Scans and Risks tab.
  4. Find Exclusions / Low Risks at the bottom.
  5. Click Configure next to “Signatures to Exclude from All Scans.”
  6. Note: You may also need to add the URL under Settings > Firewall > Intrusion and Browser Protection > Restricted Sites.

Current Context: As noted in the information you provided, Ecohulls (Business ID: 3603488-6) is a legitimate Finnish company. Their mission is purely environmental—cleaning hulls to avoid biocide paint. The block is almost certainly a “False Positive” reputation block because the site is small and located in a region (Finland) that your local Norton settings might be viewing with high sensitivity.

=====================

fwiw ~ as test: I’ve disabled Norton 360 Safe Web | Auto-Protect | Smart Firewall
Now, I can reach https://ecohulls.org/en sans VPN on

btw ~ reproducible

========================

Key Takeaway from Your Test
Excellent detective work—disabling Safe Web, Auto-Protect, and Smart Firewall consistently allows access to https://ecohulls.org/en without VPN. This reproducibility proves Norton’s layered protections are overzealously flagging the site as a false positive.

Root Cause Summary

  • Heuristic Flags: Low-traffic Finnish domain (small biz) triggers Norton’s IPS/Firewall rules for “suspicious” traffic.
  • VPN Bypass: Encrypted tunnel routes via a virtual adapter Norton trusts more

=============================

Neo Browser AI personal assistant by Gen Digital may make mistakes .
Note: for critical matters like billing, legal issues, or account security, it is always best to verify directly with Official Norton Support

The fact that AbuseIPDB and Sucuri both report a 404 error while you can access the site (with Norton disabled) confirms a specific technical setup: The Ecohulls server is actively hiding from automated tools.

This “invisibility” is exactly why Norton is flagging it as a “False Positive.” Here is the breakdown of why these reputation tools are failing to see what you see.

:prohibited: Why AbuseIPDB and Sucuri get a 404

When security tools like AbuseIPDB or Sucuri try to scan a site, they don’t browse like a human. They use “headless” bots or scripts from known data center IP addresses.

  • Aggressive Bot Mitigation: The server hosting ecohulls.org in Finland likely uses a firewall (like Wordfence, BitNinja, or a custom Nginx configuration) that is set to “Drop” or “404” any request that doesn’t look like a standard web browser.
  • Data Center Blocking: Many small businesses block traffic from data centers (where Sucuri and AbuseIPDB servers live) to prevent DDoS attacks and scrapers. Since the scanner can’t “see” the page, it reports a 404 (Not Found).
  • The “Shadow” Effect: To a security tool, a site that exists for humans but 404s for bots looks suspicious or “cloaked,” which is a common tactic used by malware. Norton’s automated crawlers likely saw this same “404” behavior and flagged the domain as “untested” or “risky.”

:link: The Connection to Your Norton Block

This explains the “Reproducible” nature of your problem:

  1. Norton’s Reputation Engine tried to scan ecohulls.org.
  2. The Finnish Server blocked Norton’s bot (giving it a 404 or a timeout).
  3. Norton then categorized the site as “Low Reputation” or “Suspicious” because it couldn’t verify the content.
  4. Your Local Norton 360 now blocks the site to “protect” you from what it perceives as a mysterious, unverified domain.

:hammer_and_wrench: Why the VPN “Fixes” It

When you turn on the Norton VPN:

  • You are no longer coming from your home ISP (which might be tied to a specific routing path Norton is watching).
  • You are using an encrypted tunnel that often bypasses the local Intrusion Prevention System (IPS) signatures on your PC.
  • The VPN allows you to “tunnel” past the local software block that is strictly enforcing the “404/Suspicious” rule.

:speedboat: Conclusion: The Site is Legit, the Firewall is Strict

Your testing has mapped out a classic conflict between a highly defensive server (Ecohulls) and an overly cautious security suite (Norton).

Ecohulls Business Summary:

  • Service: Environmentally friendly mechanical hull cleaning (no biocides).
  • Location: Kimito, Finland (Sjölaxvägen 194).
  • Key Personnel: Viggo Henelius and Fynn Robering.
  • Status: Legitimate business (ID: 3603488-6), currently suffering from a “False Positive” reputation block due to their server’s strict security settings.

Since you’ve proven you can reach it by disabling Norton, the most permanent solution is to re-enable your Norton 360 but add ecohulls.org as an Exclusion in the Antivirus and Firewall settings.

=============================

Neo Browser AI personal assistant by Gen Digital may make mistakes .
Note: for critical matters like billing, legal issues, or account security, it is always best to verify directly with Official Norton Support

=======================

Edit: after machine Restart
I can access https://ecohulls.org/en with Norton 360 Safe Web disabled.
With Norton 360 Safe Web enabled. I’m not getting Norton 360 Safe Web notice.
Edge

Edit 2:
With Norton 360 Safe Web enabled.
Chrome
I can now reach https://ecohulls.org/en

========================

With Norton 360 Safe Web enabled…at this time.
I cannot reach https://ecohulls.org/en from Edge
I can reach https://ecohulls.org/en from Chrome

=================================
Maybe, my Norton 360 install needs a refresh.

fwiw ~ at this time:
https://ecohulls.org/en

fwiw ~ at this time:
https://ecohulls.org/en

image

======================

fwiw ~ at this time…with Norton 360 Safe Web enabled
I cannot reach https://ecohulls.org/en from Chrome or Edge
I’m not getting Norton 360 Safe Web popup

Note: Detected by Safe Web popup…works with URLhaus samples

Edit: fwiw ~ opened support case

Neo Browser AI personal assistant by Gen Digital may make mistakes .
Note: for critical matters like billing, legal issues, or account security, it is always best to verify directly with Official Norton SupportContact us

fwiw ~ at this time:
https://ecohulls.org/en

Hi @Viggo

The reported url is analyzed as safe now. Thank you for the patience in allowing us to get this resolved.

1 Like