Norton Safe Web incorrectly blocking legitimate website as URL:Blacklist

[Phunkemedia]

I am the verified owner/administrator of kfconsulting.com.au, a legitimate Australian business website.

Norton Safe Web currently rates the domain Warning and blocks access with:

• Threat name: URL

• Severity: 2

• Threat type: Miscellaneous

• Detected by: Safe Web

The block occurs on the homepage and also on WordPress administrative URLs, suggesting this is a domain-level Safe Web classification.

I have investigated the website and found no evidence of active malware. Monarx Malware Scanner reports no malware detected, and Monarx ThreatShield reports no suspicious activity detected. Wordfence is installed with its Web Application Firewall enabled. I have also manually reviewed the WordPress root configuration, .htaccess, Wordfence WAF configuration, uploads, mu-plugins, plugins and themes and found no obvious malicious redirects, injected scripts, suspicious external domains or malicious PHP files.

I have completed Norton Safe Web site ownership verification using the HTML authentication-file method. Norton now identifies me as the verified Site Owner and provides a “Re-evaluate site ratings” option.

However, the re-evaluation page is unusable because it is covered by a grey overlay. I also attempted the official Norton false-positive submission form. I was able to complete the form, but when I submitted it, Norton returned:

Access Denied

“You don’t have permission to access the Norton false-positive submission page on this server.”

Reference: #18.96c7ce17.1790128721.8eb2751

I am therefore unable to complete the normal false-positive/re-evaluation process.

Could a Norton Safe Web / Threat Intelligence team member please manually review kfconsulting.com.au and investigate the URL classification?

If Norton is detecting a specific malicious resource, URL, script or other technical indicator, please identify it so that I can investigate it immediately. If this is a false positive, please re-evaluate the site and remove the Warning classification.

This is a live client website and the Norton block is preventing affected users from accessing it.
Thank you.

[bjm]

@Phunkemedia

Norton Safe Web incorrectly blocking legitimate website as URL:Blacklist
I am the verified owner/administrator of kfconsulting.com.au, a legitimate Australian business website.
Norton Safe Web currently rates the domain Warning and blocks access with: […]
Could a Norton Safe Web / Threat Intelligence team member please manually review kfconsulting.com.au and investigate the URL classification?

Hello @Phunkemedia
Welcome to the Norton Community!

Understanding Norton Site Re-Evaluations

https://kfconsulting.com.au/

++++++++++++++++++++++++++++++++++++++++++++++

@Phunkemedia

I have completed Norton Safe Web site ownership verification using the HTML authentication-file method. Norton now identifies me as the verified Site Owner and provides a “Re-evaluate site ratings” option.

However, the re-evaluation page is unusable because it is covered by a grey overlay. I also attempted the official Norton false-positive submission form. I was able to complete the form, but when I submitted it, Norton returned:

Access Denied
“You don’t have permission to access the Norton false-positive submission page on this server.”
Reference: #18.96c7ce17.1790128721.8eb2751

Message: “Access denied”, this webpage is not accessible from your current IP address

Norton’s web application firewall (Akamai CDN) has temporarily blocked your current IP address from accessing the submission portal. The string starting with #18... is an Akamai reference error code, usually triggered when an IP address is flagged for a poor security reputation, or when a security block is triggered by an active VPN, proxy, or browser extension.

You are encountering two distinct types of technical blocks: a browser-side rendering issue (the grey overlay) and a server-side Web Application Firewall (WAF) block (the “Access Denied” error).

---

1. Fixing the Grey Overlay on the Re-evaluation Page

The grey overlay is a malfunctioning layout element, usually caused by a blocked cookie consent banner, a broken reCAPTCHA box, or an aggressive browser extension.

• Try an Incognito/Private Window: Open a completely private browsing session with all extensions disabled. Ad-blockers, script-blockers, and even the Norton Safe Web extension can inadvertently block the scripts required to clear that overlay.
• Use a Different Browser: If you are using Chrome, try switching to Firefox or Edge (or vice-versa) to force the scripts to render cleanly.
• Manually Delete the Overlay (For Advanced Users):
  1. Right-click the grey overlay and select Inspect to open your browser’s Developer Tools.
  2. Look for the highlighted HTML line (usually a <div> tag with a class name like overlay, modal-backdrop, or grey-out).
  3. Press Delete on your keyboard to manually remove the element from your screen so you can click the form underneath.

---

2. Resolving the “Access Denied” Submission Error

The error message and the reference number layout indicate that Akamai (Norton’s Web Application Firewall/CDN provider) has flagged your submission payload or connection. This security mechanism automatically blocks requests it deems suspicious.

• Turn Off Your VPN or Proxy: WAFs strictly filter traffic coming from commercial VPNs and proxy servers. Disabling them entirely usually resolves Akamai blocks immediately.
• Switch Your Network Connection: If your local residential IP has inherited a poor reputation, try submitting the form from a mobile device using cellular data instead of your local Wi-Fi.
• Check for Prohibited Form Content: Ensure your description text doesn’t contain heavy HTML coding, excessive special characters, or strings that resemble a code injection attack, as the firewall may misinterpret them as malicious payload.

---

@Phunkemedia

However, the re-evaluation page is unusable because it is covered by a grey overlay.

Norton Private Browser

AI sourced content may make mistakes