False Positive – joytoyfigure.com still flagged after dispute submission

[Joytoyfigure]

Hi everyone,

I submitted a false positive dispute for my website but have not received any response. The site is flagged as “Fake E-Store” however, I’ve checked my website via alot of other channel like virustotal, scamadviser…but there is no issue found. My store was created long time ago and have many reviews (trust pilot with 3.9/5). The site also uses verified PayPal and Stripe merchant accounts • Trustpilot: 3.9/5 from verified customers

I tried to request a review a week ago but there is no response from the Safe Web team, so anyone know how to solve the problem?

Thank you guys a lot

[bjm]

@Joytoyfigure

I tried to request a review a week ago but there is no response from the Safe Web team, so anyone know how to solve the problem?

Hello @Joytoyfigure

Note: after submitting dispute and waiting 48 business hours with no change.
Contact official Norton Support and advise support that you’ve submitted dispute and waited 48 business hours. My understanding is…once you state that you have already submitted False Positive over the submission portal and waited 48 business hours…support agent shall take the URL and detection screenshot and advance the case.

Norton Submission Portal is used for submitting false positive reports.
Verified site owners generally have access to a dashboard where they can see the status of their site and any pending disputes.
If the status of your site has not changed – on the Safe Web public lookup – after 48 business hours – contact official Norton Support directly. Explicitly tell the agent: “I have already submitted a site dispute via the Safe Web portal more than 48 hours ago and have not received a status update.” This often prompts support to escalate the ticket manually.

Norton Submission Portal does not send automated confirmation or status update emails, even when an email address is provided.
If the review determines the detection was indeed a false positive, Norton typically releases updated definitions to address it within 48 hours without specifically notifying the submitter.

[bjm]

https://joytoyfigure.com

Threat name: URL:EshopScam
URL: joytoyfigure.com
Detected by: Web Shield | URL scanning
Alert ID: 18e7159eb2bd

07d22343c6d5/2026-05-12T06:27:07.950Z
c11e14ca72f6/2026-05-12T06:27:09.241Z
47dc89d226a1/2026-05-12T06:27:09.278Z
0dbd7b41b3cb/2026-05-12T06:27:09.326Z
940778e31420/2026-05-12T06:27:09.351Z
8b2f9f3152c5/2026-05-12T06:27:09.388Z
05c167aab75a/2026-05-12T06:27:09.415Z
14a66092fbbd/2026-05-12T06:27:09.451Z

[bjm]

https://joytoyfigure.com/

https://sitecheck.sucuri.net/

403 Forbidden
This error code may mean the site was disabled by its hosting provider because of malware problems. The site also may be under maintenance at the moment and you should try scanning it later. Another possible reason is some parts of the website have restricted access and our scanner could not scan them.

https://www.virustotal.com/

https://www.abuseipdb.com/
We resolved the domain joytoyfigure.com to IP address 104.17.232.29
IP Abuse Reports for 104.17.232.29:
This IP address has been reported a total of 20 times from 16 distinct sources. 104.17.232.29 was first reported on November 8th 2022, and the most recent report was 4 months ago.
Old Reports: The most recent abuse report for this IP address is from 4 months ago . It is possible that this IP is no longer involved in abusive activities.

https://www.virustotal.com/

[bjm]

fwiw ~ as test: Norton 360 Safe Web | Web Shield disabled
Norton Private Browser – https://joytoyfigure.com/

URL:FakeShop and URL:EshopScam are very similar Norton reputation detections. Both generally mean Norton believes a website may be an unsafe or deceptive online store rather than a traditional malware-infected site.

The difference is mostly in classification wording and detection-family naming:

• URL:FakeShop

  • Usually means Norton suspects the site is a counterfeit, impersonation, or fraudulent shopping website.
  • Often tied to:
    • copied storefront templates
    • unrealistic discounts
    • fake reviews
    • recently created domains
    • weak or hidden business identity
  • Think: “this store may not be genuine.”

• URL:EshopScam

  • Similar category, but more directly indicates scam-like e-commerce behavior.
  • Often associated with:
    • payment collection without delivery
    • bait pricing
    • disappearing storefronts
    • fake checkout systems
    • social-media-ad scam shops
  • Think: “this online shop may intentionally scam buyers.”

In practice, Norton users should treat both as:

“Use caution — this shopping site has a poor trust/reputation profile.”

Neither label automatically means:

• the site contains malware
• your device is infected
• visiting the page alone compromised your PC

Instead, these are often reputation/risk detections based on scam indicators and shopping-site behavior patterns.

A site can even appear “clean” on malware scanners yet still receive these Norton labels because Norton Safe Web also evaluates trustworthiness and scam signals, not just malicious code.

Norton 360 Safe Web engine and Norton Private Browser Web Shield were already aligned. Recent updates have extended that alignment to the Norton Safe Web portal and browser extension, with all now using a shared backend reputation database. Classifications should generally match, though real-time detection may still introduce occasional differences.

=============================================

joytoyfigure.com appears to fall into the “mixed reputation / caution advised” category rather than an obvious confirmed scam.

• Trustpilot shows a moderate reputation with many successful orders, but also complaints about delayed shipping and slow customer support.

• ScamAdviser and similar automated reputation services flag the site as “caution” or “medium risk” because of similarities to other questionable shops and low traffic patterns.

• Reddit feedback from collectors is mixed:

  • many users report eventually receiving authentic figures
  • multiple users complain about communication delays, preorder issues, replacement-part problems, or cancellations after long waits

So in Norton-style terminology, this feels more like:

• URL:FakeShop / URL:EshopScam suspicion signals
  rather than
• confirmed malware hosting.

That distinction matters because:

• the site may still deliver real products,
• but reputation systems may distrust it due to customer-service patterns, fulfillment complaints, deceptive branding (“looks official”), or scam-like ecommerce indicators.

A cautious assessment would be:

Area	Assessment
Malware risk	No strong evidence found
Legitimate deliveries	Yes, many reports
Customer support reliability	Mixed to poor
Shipping consistency	Mixed
Refund/dispute risk	Higher than established retailers
“Official store” confusion	Common complaint

If someone chooses to order there, safer practices would include:

• paying with a credit card or PayPal (buyer protection),
• avoiding large preorders,
• avoiding rare/high-dollar items for a first purchase,
• keeping screenshots and order emails.

AI sourced content may make mistakes

[bjm]

https://joytoyfigure.com/