False Positive – medaz.ro still showing Warning after dispute – Manual Review Requested

[utilizator8]

Note: Please do not post Personally Identifiable Information like email address, personal phone number, physical home address, product key etc.

Issue abstract:
Norton Safe Web is incorrectly showing a Warning for medaz.ro. A false-positive dispute was submitted more than 48 hours ago, but the rating has not changed.

Detailed description:
I am contacting you on behalf of MEDAZ LIFE CONSUM SRL, operator of www.medaz.ro an established Romanian e-commerce website selling medical supplies and medical equipment.

Norton Safe Web currently rates our domain as Warning, and Norton users are receiving a security warning when attempting to access our website.

We submitted a false-positive/site dispute more than 48 hours ago, but the Safe Web rating has not changed.

We have extensively investigated the website and found no evidence of active malware, phishing, malicious redirects or card-skimming activity.

Other security vendors that previously flagged the domain have already removed their negative classifications following review, and Google Safe Browsing currently reports no unsafe content.

Could a Norton employee please escalate medaz.ro to the Safe Web / Threat Intelligence team for a manual review?

If Norton still detects a threat, please provide the specific threat name, affected URL/resource, script or technical indicator responsible for the Warning rating so that we can investigate and remediate it immediately.

Product & version number:
Norton Safe Web

OS details:
Not applicable – this is a domain reputation issue.

What is the error message you are seeing?
Norton Safe Web rating: Warning

If you have any supporting screenshots, please add them:
Screenshot attached showing the current Norton Safe Web Warning rating for medaz.ro.

[bjm]

• Norton Submission Portal is used for submitting false positive reports.
• Verified site owners generally have access to a dashboard where they can see the status of their site and any pending disputes.
• If the status of your site has not changed – on the Safe Web public lookup – after 48 business hours – contact official Norton Support directly. Explicitly tell the agent: “I have already submitted a site dispute via the Safe Web portal more than 48 hours ago and have not received a status update.” This often prompts support to escalate the ticket manually.
  Note: an active paid subscription is required to open a direct support ticket.

• Norton Submission Portal does not send automated confirmation or status update emails, even when an email address is provided.
  If the review determines the detection was indeed a false positive, Norton typically releases updated definitions to address it within 48 hours without specifically notifying the submitter.

Submitting through the official portal at submissions.norton.com evaluates only the specific URL path you type into the box. It will not trigger a domain-wide rescan.
Domain-wide rescan request can only be triggered by the site owner who has verified their site.

By forcing owners to go through the Norton Safe Web Owner Portal and place a cryptographic meta tag into the website’s HTML, Norton filters out general traffic noise. This verification ensures that a real human analyst or a resource-heavy, top-to-bottom structural recursive domain crawl (/*) is only deployed for authenticated administrators who legally control the domain platform.

A public guest submission is simply an automated single-point string fix. Only a verified site owner filing an official site dispute can break through that automation to clear an entire domain tree.

• Unverified Public Submissions resolve symptoms (individual web links).
• Verified Owner Site Disputes resolve the root cause (the entire domain-wide wildcard status).

• Verified Site Owners: Once you verify ownership (via HTML file or meta tag) in the Norton Safe Web portal, you gain access to the “Re-evaluate my site” button for your entire domain. This triggers a comprehensive scan of the root domain and its subdomains.
• Retail Users (General Public): Users without verified ownership can only submit a specific URL for review via the general “Submit a website” form. This submission is limited to the single URL provided and does not trigger a full domain-wide scan, nor does it grant the user access to ownership tools or status dashboards.

This distinction ensures that only authorized administrators can request broad reputation changes for a domain, preventing malicious actors from manipulating ratings for sites they do not control.

The primary escalation path for verified owners is a two-step process involving an automated form followed by community escalation if the automated review stalls.

Primary Venue: The Safe Web Dispute Portal
This is the official channel for all site owners.

• Action: Log in to your free Norton account, go to the Site Dispute tab, and click “Re-evaluate my site.”
• Function: This submits your case to the automated review queue. Verified owners can see the status of this dispute in their dashboard.
• Limitation: You cannot speak to a human agent during this initial submission.

Escalation Venue (If the Portal Stalls)
If the automated review does not resolve the issue within 48 business hours, verified owners have escalation venue that functions as alternative to a standard support ticket:

• The Norton Community Forums:
  • This is the most effective “human” venue for non-subscribers. Norton employees actively monitor the Norton Community Forums.
  • Procedure: Post a thread detailing your URL, stating you are a verified owner, and noting that your dispute has been stuck in the portal for more than 48 hours. Staff frequently manually escalate these forum posts to the team.

[bjm]

@utilizator8

Could a Norton employee please escalate medaz.ro to the Safe Web / Threat Intelligence team for a manual review?

Hello @utilizator8
We’ll try to call attention:
https://medaz.ro/

Threat name: URL:Blacklist
URL: medaz.ro
Detected by: Web Shield | URL scanning
Alert ID: 549f37227cc4
Alert ID: a200fa9441d8

e937b324f023/2026-08-28T08:58:07.751Z
8488b233ab2e/2026-08-28T09:11:57.697Z

e937b324f023/2026-08-28T08:58:07.751Z
8488b233ab2e/2026-08-28T09:11:57.697Z

[utilizator8]

Thank you very much

[bjm]

https://medaz.ro/

AbuseIPDB » 116.202.214.140
We resolved the domain medaz.ro to IP address 116.202.214.140
No one has reported 116.202.214.140 for abusive activity, so its abuse confidence score is currently 0%.

[Selvakumar.S]

Hi @utilizator8

Thank You for reporting the issue on Norton Community. The reported url is now resolved as False Positive. Could you please check now?

Thanks !

[bjm]

https://medaz.ro/