False Positive for OiiOii.ai, No Response to Dispute

[user13608]

Issue abstract: Norton Safe Web is showing a warning for my website, oiioii dot ai, but no specific affected URL, file, or security issue has been provided.

Alert ID: N/A. I do not see an Alert ID on the Norton Safe Web report page or in the warning screenshot.

Product & version number: Norton Safe Web website rating / Norton Safe Web protection

OS details: N/A. This does not appear to be a browser-specific issue. Users in Japan have encountered the same warning in Safari, Google Chrome, and Brave.

What is the error message you are seeing?

Norton Safe Web is currently showing a Warning rating for my website: www.oiioii.ai

The warning reports the following detection:

Threat name: URL:Block [Rat]
Threat type: Remote Access Trojan
URL: www.oiioii.ai
Detected by: Safe Web

I own and operate the site. It is a legitimate AI animation creation platform.

The issue was first reported by users in Japan on July 16, 2026. The same Norton warning appeared in multiple browsers.

I submitted a false-positive URL dispute through the Norton Submission Portal on 2026-07-16, but I have not received a response, confirmation, or details about what is being flagged.

Reference number: N/A – no reference number was provided

I have checked the domain with other security services:

Google Safe Browsing: No unsafe content found.

VirusTotal domain report: 0 out of 91 security vendors detected the domain as malicious.

VirusTotal exact URL report: 0 out of 92 security vendors detected the homepage URL as malicious.

VirusTotal Japan CDN IP report: 0 out of 91 security vendors detected the IP address as malicious.

We also compared the homepage content returned by CDN nodes in Japan, the United States, and Asia. All tested nodes returned identical HTML content. The website’s TLS certificate is valid and issued by DigiCert/RapidSSL.

I’m not aware of any malware, remote-access software, phishing pages, deceptive downloads, suspicious redirects, or injected content on the site.

If Norton has identified a specific URL, file, redirect, script, external resource, or security issue, I would appreciate those details so I can review and fix anything necessary.

Desired outcome: Manual review of oiioii dot ai and www.oiioii dot ai, details about the specific issue if one exists, and removal of the warning if the URL:Block [Rat] detection is a false positive or stale reputation record.

If you have any supporting screenshots, please add them:

[bjm]

@user13608

oiioii dot ai

https://oiioii.ai/

Threat name: URL:Block [Rat]
URL: oiioii.ai
Detected by: Web Shield | URL scanning
Alert ID: 3e8efd9684ff

fab8406c27a3/2026-07-20T03:13:01.892Z

fab8406c27a3/2026-07-20T03:13:01.892Z

[bjm]

• Norton Submission Portal is used for submitting false positive reports.
• Verified site owners generally have access to a dashboard where they can see the status of their site and any pending disputes.
• If the status of your site has not changed – on the Safe Web public lookup – after 48 business hours – contact official Norton Support directly. Explicitly tell the agent: “I have already submitted a site dispute via the Safe Web portal more than 48 hours ago and have not received a status update.” This often prompts support to escalate the ticket manually.

• Norton Submission Portal does not send automated confirmation or status update emails, even when an email address is provided.
  If the review determines the detection was indeed a false positive, Norton typically releases updated definitions to address it within 48 hours without specifically notifying the submitter.

Submitting through the official portal at submissions.norton.com evaluates only the specific URL path you type into the box. It will not trigger a domain-wide rescan.
Domain-wide rescan request can only be triggered by the site owner who has verified their site.

False detection reported through a “Threat Secured” notification popup is strictly path-specific.

By forcing owners to go through the Norton Safe Web Owner Portal and place a cryptographic meta tag into the website’s HTML, Norton filters out general traffic noise. This verification ensures that a real human analyst or a resource-heavy, top-to-bottom structural recursive domain crawl (/*) is only deployed for authenticated administrators who legally control the domain platform.

A public guest submission is simply an automated single-point string fix. Only a verified site owner filing an official site dispute can break through that automation to clear an entire domain tree.

• Unverified Public Submissions resolve symptoms (individual web links).
• Verified Owner Site Disputes resolve the root cause (the entire domain-wide wildcard status).

[bjm]

https://sitecheck.sucuri.net/
https://oiioii.ai

https://www.virustotal.com/

https://www.abuseipdb.com/
We resolved the domain oiioii.ai to IP address 101.47.173.166
IP Abuse Reports for 101.47.173.166:
This IP address has been reported a total of 14 times from 5 distinct sources. 101.47.173.166 was first reported on January 5th 2026, and the most recent report was 1 month ago.
Old Reports: The most recent abuse report for this IP address is from 1 month ago . It is possible that this IP is no longer involved in abusive activities.

[bjm]

https://www.oiioii.ai/home

Threat name: URL:Block [Rat]
URL: www.oiioii.ai
Detected by: Web Shield | URL scanning
Alert ID: 8d9b2daa87d3

def272314e30/2026-07-20T03:48:18.624Z

def272314e30/2026-07-20T03:48:18.624Z

URL:Block [Rat] is a specific detection label used by Norton Safe Web (and related Norton security products) to indicate that a website has been flagged as a Remote Access Trojan (RAT) distribution point or a command-and-control server.

• RAT (Remote Access Trojan): This is a type of malware that allows an attacker to control a victim’s computer remotely as if they were sitting in front of it. It is often used to steal data, install other malware, or take screenshots.
• URL:Block: This prefix indicates that the threat was identified on a specific web address (URL), not necessarily a downloaded file. Norton’s scanning engine likely detected a script, redirect, or embedded content on that page that matches the behavior of a RAT.

[bjm]

Hello @user13608

https://www.oiioii.ai/home

[Selvakumar.S]

Hi @user13608

Thank You for reporting the issue on Norton Community. The reported url is now resolved as False Positive. Could you please check now?

Thanks !

[user13608]

Good, it shows normal now