False Positive Report - No Response

user13933 · 7 October 2026 16:15

Hi, one of our organization sites has been flagged with a warning via Norton Safe Web. It is a SAML implementation which handles login for our educational association users to apps. A dispute was submitted over a week ago, but has gone unanswered. During this busy period this warning is preventing certain users from accessing important application. Is there a way to escalate?

URL: pictured below

Thank you

bjm · 7 October 2026 16:40

Hello @user13933
Welcome to the Norton Community!

Understanding Norton – Site Re-Evaluations

We’ll try to call attention:
https://sso.principals.org/

Threat name: URL:Blacklist
URL: sso.principals.org
Detected by: Web Shield | URL scanning
Alert ID: 7d74ac8841af

image413×498 91.1 KB

image417×406 75.2 KB

259d4634bc1d/2026-10-07T16:42:06.031Z
3934697966b3/2026-10-07T17:01:07.745Z

image491×140 66.9 KB

user13933 · 7 October 2026 16:43

I appreciate it

bjm · 7 October 2026 16:44

Hello @user13933
Have you verified domain ownership?

Understanding Norton – Site Re-Evaluations

user13933 · 7 October 2026 16:47

Are there some directions on doing that for Norton? I can go ahead and do that now.

bjm · 7 October 2026 16:49

Understanding Norton – Site Re-Evaluations
The Norton Submission Portal handles all false positive reports. The platform utilizes distinct scanning logic depending on whether a request originates from a verified administrator or the general public:

Verified Site Owners: Once domain ownership is verified (via HTML file or meta tag) in the Norton Safe Web Portal, submitting a dispute through an authenticated account routes the request as a webmaster ticket. The backend cross-references the account data to trigger a comprehensive, high-priority, domain-wide scan of the root domain and its subdomains.

Retail Users (General Public): Users without verified ownership can submit specific links through the public portal. This submission is limited to evaluating the exact URL string provided, does not trigger a domain-wide scan, and grants no administrative insights.

The Rationale: This architectural distinction ensures that only authorized administrators can trigger broad, domain-wide reputation re-evaluations. By requiring a cryptographic meta tag or HTML file, Norton verifies administrative control before deploying resource-heavy, top-to-bottom structural recursive domain crawls (/*) or manual engineering reviews. Ultimately, public submissions address local symptoms (individual links), while verified owner disputes address the root status of the entire domain.

The Dispute Process & Escalation Paths
The primary review path for verified owners is a two-step process involving an initial automated form followed by specific escalation channels if the review requires manual intervention.

Step 1: The Safe Web Dispute Portal (Primary Venue)
This is the official initial channel for all site owners.

Action: Log in to your Norton account, navigate to the dashboard, and click the re-evaluation link.

Process Flow: The dashboard link redirects users to the unified public submission portal form. This is standard behavior; the backend automatically identifies your verified status using your authenticated account email.

Notifications & Tracking: Norton processes these submissions automatically and typically does not issue automated confirmation emails or status updates. Because the dashboard does not contain a live dispute tracking bar, owners should monitor progress by checking the public Norton Safe Web Portal. If the review determines the detection was a false positive, updated definitions are generally released to address it within 48 hours.

Step 2: Escalation Venues (If the Portal Stalls)
If the public lookup status has not changed after 48 business hours, owners can utilize the following official alternative venues to request a manual review:

Option A: The Norton Community Forums
The community forum is actively monitored by Norton employees and serves as an effective route for standard account holders.

Procedure: Post a thread detailing your URL. State that you are a verified owner and that your portal submission has been pending for more than 48 hours. Staff moderators can manually pull the ticket from the backend queue for engineering review.

Option B: Direct Norton Support (Paid Subscribers Only)
An active, paid Norton subscription for personal or business security products allows owners to open a direct support ticket.

Procedure: Contact official support via live chat or phone. Inform the agent: “I have already submitted a site dispute via the Safe Web portal more than 48 hours ago and have not received a status update.” This specific phrasing allows the agent to route the ticket directly to the web security team.