We are getting false positive WARNING on our shopify site. It shows clean on all the other major services. Can someone please update your database
bjm
May 3, 2026, 11:36pm
2
Submit a file or URL to Norton for review
Note: after submitting dispute and waiting 48 business hours with no change. Norton Support and advise support that you’ve submitted dispute and waited 48 business hours. My understanding is…once you state that you have already submitted False Positive over the submission portal and waited 48 business hours…support agent shall take the URL and detection screenshot and advance the case.
=============================================
Submission Portal: Norton Submission Portal . This system is used for tracking false positive reports.Site Ownership: Ensure you have officially “claimed” your website within the Safe Web portal . Verified owners generally have access to a dashboard where they can see the status of their site and any pending disputes without relying solely on email notifications.48 hours: Community suggests waiting 48 business hours. If the status of your site has not changed on the Safe Web public lookup after this time, it likely means the dispute is still in the queue or was not processed.Norton Support: If you haven’t received an email or a status change after 48 hours, contact official Norton Support directly. Explicitly tell the agent: “I have already submitted a site dispute via the Safe Web portal more than 48 hours ago and have received no email notification or status update.” This often prompts support to escalate the ticket manually.
bjm
May 3, 2026, 11:39pm
3
Hello @user13379
https://arkansasminerals.com/
173782cc55aa
506a31332483/2026-05-03T23:41:06.495Z
506a31332483/2026-05-03T23:41:06.495Z
The detection “URL:FakeShop” / “URL:EshopScam” shown by Norton 360 Safe Web / Web Shield is a reputation-based classification , not a malware verdict.
This label is applied when a website exhibits characteristics commonly associated with high-risk or potentially deceptive online stores . These signals can include factors such as:
Limited or unverifiable business identity
Recently registered or low-reputation domain
Website content patterns seen in prior scam reports
Lack of established trust signals (independent reviews, verifiable contact details, etc.)
It’s important to clarify:
This detection does not indicate that the site is infected with malware
It reflects risk assessment based on reputation and observed patterns
For site owners
If you believe this classification is incorrect, you can request a review through Norton Safe Web :
Submit your site for re-evaluation via the Safe Web portal
Ensure your site clearly displays verifiable business information (company name, physical address, contact details)
Provide transparent policies (shipping, returns, refunds)
Build a consistent, trustworthy online presence
Once reviewed, Norton may update the site’s rating if it meets trust and safety criteria.
VirusTotal primarily aggregates results from engines that look for:
malware (exploits, trojans, phishing payloads)
known malicious URLs or scripts
If a site like arkansasminerals.com doesn’t host malware or active exploits , many engines on VirusTotal may return clean results .
Where Norton differs
**Norton 360 Safe Web is doing something broader:
It evaluates site reputation and trustworthiness
It can flag consumer-risk scenarios , not just technical threats
So a label like “URL:FakeShop” / “URL:EshopScam” generally means:
The site shows patterns consistent with potentially deceptive or untrustworthy e-commerce behavior , even if it is not technically malicious.
Why results may differ from scanners
Services like VirusTotal often focus on malware and exploit detection , so a site can appear “clean” there while still being flagged by Norton for trustworthiness concerns
Bottom line
“EshopScam” / “FakeShop” = potentially deceptive or untrustworthy e-commerce site
Not necessarily malicious, but use caution
For site owners
If this classification is believed to be incorrect, you can request a review via Norton Safe Web by submitting the site for re-evaluation and ensuring clear, verifiable business information is present.
AI sourced content may make mistakes
Norton protections use multiple layers (reputation systems, URL classifications, and behavioral heuristics), which do not always update simultaneously. This can result in different components showing different statuses for the same site.
In such cases, the Safe Web portal reflects the most current cloud-based reputation , while in-product detections (e.g., “FakeShop”, “EshopScam”, or script-based alerts) provide additional context about observed risk. These signals should be considered collectively , rather than relying on a single indicator.
The Safe Web portal reflects Norton’s current cloud-based reputation and is updated more frequently, whereas the browser extension may rely on locally cached data that can lag behind recent changes.
The Norton Safe Web portal showing Warning likely reflects the most current cloud-based reputation
The in-product detection from Norton 360 (URL:FakeShop ) is an independent signal reinforcing elevated risk
The extension showing Safe is likely lagging (cache/update timing), not wrong , just not current
When the Safe Web portal reports Warning and Norton product detections flag the site (e.g., FakeShop ), those combined signals indicate elevated risk. A “Safe” rating in the browser extension may lag due to caching and should not be relied upon in isolation.
Norton uses a shared intelligence system, but different components update on different cycles. Temporary differences (e.g., portal = Warning while an extension still shows Safe) can occur during reclassification. Over time, these signals typically converge as updates propagate.
Depending on caching, update timing, and how quickly reputation changes propagate across Norton components, results may temporarily vary until all layers reflect the same classification.
AI sourced content may make mistakes
bjm
May 4, 2026, 12:35am
4
https://arkansasminerals.com/
bcb28fe1f354/2026-05-04T00:32:58.992Z
3537d105de10/2026-05-04T00:32:58.992Z
f62170ecaad9/2026-05-04T00:33:05.044Z
903e18bd47ca/2026-05-04T00:33:05.052Z
66dd4fc743ec/2026-05-04T00:33:05.081Z
a588b1e0133d/2026-05-04T00:33:05.144Z
ac5e535548df/2026-05-04T00:33:05.178Z
deaabb3c26c1/2026-05-04T00:33:05.214Z
7dbb152d55b3/2026-05-04T00:33:06.964Z
ffe0513a07f7/2026-05-04T00:33:06.993Z
Alert IDs are internal identifiers Norton assigns to individual detection events. They are used for logging, correlation, and improving threat intelligence. Multiple Alert IDs indicate repeated or related detections, not separate threats.
A higher number of Alert IDs typically occurs during initial page loads or redirects when multiple elements are being processed. Once the site is blocked and no further content loads, subsequent attempts may generate only a single Alert ID, reflecting a single detection event rather than multiple triggers.
ed7020f5e4e0/2026-05-04T00:49:56.013Z
A single page load can involve multiple URL resolutions, redirects, and resource requests. Each of these can be evaluated separately by Norton, which is why multiple Alert IDs may be generated during one visit, while fewer appear once the page is blocked or no longer actively loading.
448aa6c9d219
AI sourced content may make mistakes
bjm
May 4, 2026, 5:50pm
5
https://arkansasminerals.com/
a5033c11f409
bjm
May 5, 2026, 7:27pm
6
https://arkansasminerals.com/
1 Like
