False Positive Block Escalation: Verified Merchant Site Still Showing Warning

[user13008]

Hello Norton Community Moderators, I am writing to request a manual review for my e-commerce website:

I have already claimed and verified ownership of this site through my Norton Safe Web merchant account, but the system is still incorrectly applying an unsafe warning to our web traffic. We are an established British brand with a 14-year clean online track record. Our storefront runs entirely on standard, secured Shopify infrastructure. The Google Safe Browsing Transparency report confirms that our domain is 100% clean and safe. Could a forum administrator please escalate this false positive classification directly to the Safe Web team so our legitimate customers can access our store? We are getting a lot of customers of many years now be blocked from their fave website and talking about moving away from Norton due to this ? Thank you for your assistance.

[bjm]

• Norton Submission Portal is used for submitting false positive reports.
• Verified site owners generally have access to a dashboard where they can see the status of their site and any pending disputes.
• If the status of your site has not changed – on the Safe Web public lookup – after 48 business hours – contact official Norton Support directly. Explicitly tell the agent: “I have already submitted a site dispute via the Safe Web portal more than 48 hours ago and have not received a status update.” This often prompts support to escalate the ticket manually.

• Norton Submission Portal does not send automated confirmation or status update emails, even when an email address is provided.
  If the review determines the detection was indeed a false positive, Norton typically releases updated definitions to address it within 48 hours without specifically notifying the submitter.

Submitting through the official portal at submissions.norton.com evaluates only the specific URL path you type into the box. It will not trigger a domain-wide rescan.
Domain-wide rescan request can only be triggered by the site owner who has verified their site.

False detection reported through a “Threat Secured” notification popup is strictly path-specific.

By forcing owners to go through the Norton Safe Web Owner Portal and place a cryptographic meta tag into the website’s HTML, Norton filters out general traffic noise. This verification ensures that a real human analyst or a resource-heavy, top-to-bottom structural recursive domain crawl (/*) is only deployed for authenticated administrators who legally control the domain platform.

A public guest submission is simply an automated single-point string fix. Only a verified site owner filing an official site dispute can break through that automation to clear an entire domain tree.

• Unverified Public Submissions resolve symptoms (individual web links).
• Verified Owner Site Disputes resolve the root cause (the entire domain-wide wildcard status).

========== == ========== == ========== == ==========

Note: site owners cannot open a direct support ticket (chat or phone) for false positive issues without an active paid subscription.

• Verified Site Owners: Once you verify ownership (via HTML file or meta tag) in the Norton Safe Web portal, you gain access to the “Re-evaluate my site” button for your entire domain. This triggers a comprehensive scan of the root domain and its subdomains.
• Retail Users (General Public): Users without verified ownership can only submit a specific URL for review via the general “Submit a website” form. This submission is limited to the single URL provided and does not trigger a full domain-wide scan, nor does it grant the user access to ownership tools or status dashboards.

This distinction ensures that only authorized administrators can request broad reputation changes for a domain, preventing malicious actors from manipulating ratings for sites they do not control.

The primary escalation path for verified owners is a two-step process involving an automated form followed by community or phone escalation if the automated review stalls.

1. Primary Venue: The Safe Web Dispute Portal

This is the official channel for all site owners (paid or free).

• Action: Log in to your free Norton account, go to the Site Dispute tab, and click “Re-evaluate my site.”
• Function: This submits your case to the automated review queue. Verified owners can see the status of this dispute in their dashboard.
• Limitation: You cannot speak to a human agent during this initial submission.

2. Escalation Venue (If the Portal Stalls)

If the automated review does not resolve the issue within 48 business hours , verified owners have two specific escalation venues that function as alternatives to a standard support ticket:

• The Norton Community Forums (Safe Web Board):
  • This is the most effective “human” venue for non-subscribers. Norton employees (often identified as “Norton Employee” or “Symantec Employee”) actively monitor the Norton Safe Web forum section.
  • Procedure: Post a thread detailing your URL, stating you are a verified owner , and noting that your dispute has been stuck in the portal for more than 48 hours. Staff frequently manually escalate these forum posts to the threat intelligence team.
• Phone Support (With Specific Script):
  • While you cannot open a new ticket, you can call general support (e.g., 1-800-745-6061) if and only if you explicitly state: “I am a verified site owner. I have already submitted a dispute via the Safe Web portal more than 48 hours ago, and it has not been resolved.”
  • Agents generally cannot help with new site issues without a paid subscription, but they often have a protocol to escalate existing, stalled dispute cases to the Safe Web team manually.

[bjm]

Hello @user13008

https://horzehoods.com/

Threat name: URL:Phishing
URL: horzehoods.com
Detected by: Web Shield | URL scanning
Alert ID: 58f128bd92db
Alert ID: 8970faab7982

2bbe8ece9e9a/2026-08-07T15:49:03.300Z
57007e96933c/2026-08-07T16:10:33.805Z

2bbe8ece9e9a/2026-08-07T15:49:03.300Z
57007e96933c/2026-08-07T16:10:33.805Z

[bjm]

https://horzehoods.com/

==========

==========

We resolved the domain horzehoods.com to IP address 23.227.38.36
IP Abuse Reports for 23.227.38.36:
This IP address has been reported a total of 27 times from 14 distinct sources. 23.227.38.36 was first reported on February 11th 2021, and the most recent report was 4 months ago.
Old Reports: The most recent abuse report for this IP address is from 4 months ago. It is possible that this IP is no longer involved in abusive activities.

[bjm]

https://horzehoods.com/

Threat name: URL:Phishing
URL: horzehoods.com
Detected by: Web Shield | URL scanning
Alert ID: 5305f3d45df5

3e957439ea34/2026-08-08T18:27:41.806Z

https://horzehoods.com/cdn/shopifycloud/portable-wallets/latest/accelerated-checkout-backwards-compat.css

35e916edf327/2026-08-08T18:27:46.570Z

[bjm]

https://horzehoods.com/collections/special-offers

4a174ff26da6/2026-08-08T18:41:19.851Z

https://horzehoods.com/cdn/shopifycloud/portable-wallets/latest/accelerated-checkout-backwards-compat.css

80d8c5f0938b/2026-08-08T18:41:21.433Z

https://horzehoods.com/cart.js

6c7560d82eaa/2026-08-08T18:43:53.956Z

[user13008]

RESOLVED – MODERATOR PLEASE DELETE THREAD

This issue has now been fully resolved our end .

Could a Norton Community moderator please delete this entire thread as it is no longer required and contains business info.

Thank you.

[user13008]

@Norton_Ghost
This issue has now been resolved. Could an administrator please permanently delete this entire thread,

[user13008]

@Selvakumar.S Please can this thread be deleted due to info on here… this has now been resolved

[user13008]

@Chock_Norton please could this thread be deleted due to our business info being public on here as the confusions now also been resolved

[bjm]

https://horzehoods.com/

[Selvakumar.S]

Hi @user13008

Thank You for reporting the issue on Norton Community. The reported url is now resolved as False Positive. Could you please check now?

Thanks !

[bjm]

https://horzehoods.com/