Our website false positive

[user13716]

Our website show as malware, we fix a few thing and retested and all good now, we submitted for reviews but it’s been over 3 days, no answers from no one, normal ?

[bjm]

Care to share website domain name | address (space name to break link)

==================================================

• Norton Submission Portal is used for submitting false positive reports.
• Verified site owners generally have access to a dashboard where they can see the status of their site and any pending disputes.
• If the status of your site has not changed – on the Safe Web public lookup – after 48 business hours – contact official Norton Support directly. Explicitly tell the agent: “I have already submitted a site dispute via the Safe Web portal more than 48 hours ago and have not received a status update.” This often prompts support to escalate the ticket manually.

• Norton Submission Portal does not send automated confirmation or status update emails, even when an email address is provided.
  If the review determines the detection was indeed a false positive, Norton typically releases updated definitions to address it within 48 hours without specifically notifying the submitter.

Submitting through the official portal at submissions.norton.com evaluates only the specific URL path you type into the box. It will not trigger a domain-wide rescan.
Domain-wide rescan request can only be triggered by the site owner who has verified their site.

False detection reported through a “Threat Secured” notification popup is strictly path-specific.

By forcing owners to go through the Norton Safe Web Owner Portal and place a cryptographic meta tag into the website’s HTML, Norton filters out general traffic noise. This verification ensures that a real human analyst or a resource-heavy, top-to-bottom structural recursive domain crawl (/*) is only deployed for authenticated administrators who legally control the domain platform.

A public guest submission is simply an automated single-point string fix. Only a verified site owner filing an official site dispute can break through that automation to clear an entire domain tree.

• Unverified Public Submissions resolve symptoms (individual web links).
• Verified Owner Site Disputes resolve the root cause (the entire domain-wide wildcard status).

========== == ========== == ========== == ==========

Note: site owners cannot open a direct support ticket (chat or phone) for false positive issues without an active paid subscription.

• Verified Site Owners: Once you verify ownership (via HTML file or meta tag) in the Norton Safe Web portal, you gain access to the “Re-evaluate my site” button for your entire domain. This triggers a comprehensive scan of the root domain and its subdomains.
• Retail Users (General Public): Users without verified ownership can only submit a specific URL for review via the general “Submit a website” form. This submission is limited to the single URL provided and does not trigger a full domain-wide scan, nor does it grant the user access to ownership tools or status dashboards.

This distinction ensures that only authorized administrators can request broad reputation changes for a domain, preventing malicious actors from manipulating ratings for sites they do not control.

The primary escalation path for verified owners is a two-step process involving an automated form followed by community or phone escalation if the automated review stalls.

1. Primary Venue: The Safe Web Dispute Portal

This is the official channel for all site owners (paid or free).

• Action: Log in to your free Norton account, go to the Site Dispute tab, and click “Re-evaluate my site.”
• Function: This submits your case to the automated review queue. Verified owners can see the status of this dispute in their dashboard.
• Limitation: You cannot speak to a human agent during this initial submission.

2. Escalation Venue (If the Portal Stalls)

If the automated review does not resolve the issue within 48 business hours , verified owners have two specific escalation venues that function as alternatives to a standard support ticket:

• The Norton Community Forums (Safe Web Board):
  • This is the most effective “human” venue for non-subscribers. Norton employees (often identified as “Norton Employee” or “Symantec Employee”) actively monitor the Norton Safe Web forum section.
  • Procedure: Post a thread detailing your URL, stating you are a verified owner , and noting that your dispute has been stuck in the portal for more than 48 hours. Staff frequently manually escalate these forum posts to the threat intelligence team.
• Phone Support (With Specific Script):
  • While you cannot open a new ticket, you can call general support (e.g., 1-800-745-6061) if and only if you explicitly state: “I am a verified site owner. I have already submitted a dispute via the Safe Web portal more than 48 hours ago, and it has not been resolved.”
  • Agents generally cannot help with new site issues without a paid subscription, but they often have a protocol to escalate existing, stalled dispute cases to the Safe Web team manually.

[bjm]

@user13716

Our website show as malware, we fix a few thing and retested and all good now, we submitted for reviews but it’s been over 3 days, no answers from no one, normal ?

Hello @user13716
Care to share website domain name | address (space name to break link)

[user13716]

surplustek ca

[bjm]

@user13716

surplustek ca

https://surplustek.ca/

Threat name: URL:Blacklist
URL: surplustek.ca
Detected by: Web Shield | URL scanning
Alert ID: 2f314ca52736

f367a73db4c9/2026-08-18T21:17:01.870Z
832f79766afd/2026-08-18T23:45:14.330Z

f367a73db4c9/2026-08-18T21:17:01.870Z
832f79766afd/2026-08-18T23:45:14.330Z

[bjm]

https://surplustek.ca/

AbuseIPDB
We resolved the domain surplustek.ca to IP address 149.56.113.162
149.56.113.162 was not found in our database
This IP was reported 0 times.

[Selvakumar.S]

Hi @user13716

Thank You for reporting the issue on Norton Community. The reported url is now resolved as False Positive. Could you please check now?

Thanks !

[bjm]

https://surplustek.ca/

[user13716]

Wow, perfect ! Thanks

[gebruiker60]

HI We Have the same problem for our Website siltcon nl . Can you also help us?

[bjm]

Understanding Norton Site Re-Evaluations
The Norton Submission Portal handles all false positive reports. The platform utilizes distinct scanning logic depending on whether a request originates from a verified administrator or the general public:

• Verified Site Owners: Once domain ownership is verified (via HTML file or meta tag) in the Norton Safe Web Portal, submitting a dispute through an authenticated account routes the request as a webmaster ticket. The backend cross-references the account data to trigger a comprehensive, high-priority, domain-wide scan of the root domain and its subdomains.
• Retail Users (General Public): Users without verified ownership can submit specific links through the public portal. This submission is limited to evaluating the exact URL string provided, does not trigger a domain-wide scan, and grants no administrative insights.

The Rationale: This architectural distinction ensures that only authorized administrators can trigger broad, domain-wide reputation re-evaluations. By requiring a cryptographic meta tag or HTML file, Norton verifies administrative control before deploying resource-heavy, top-to-bottom structural recursive domain crawls (/*) or manual engineering reviews. Ultimately, public submissions address local symptoms (individual links), while verified owner disputes address the root status of the entire domain.

---

The Dispute Process & Escalation Paths
The primary review path for verified owners is a two-step process involving an initial automated form followed by specific escalation channels if the review requires manual intervention.

Step 1: The Safe Web Dispute Portal (Primary Venue)
This is the official initial channel for all site owners.

• Action: Log in to your Norton account, navigate to the dashboard, and click the re-evaluation link.
• Process Flow: The dashboard link redirects users to the unified public submission portal form. This is standard behavior; the backend automatically identifies your verified status using your authenticated account email.
• Notifications & Tracking: Norton processes these submissions automatically and typically does not issue automated confirmation emails or status updates. Because the dashboard does not contain a live dispute tracking bar, owners should monitor progress by checking the public Norton Safe Web Portal. If the review determines the detection was a false positive, updated definitions are generally released to address it within 48 hours.

Step 2: Escalation Venues (If the Portal Stalls)
If the public lookup status has not changed after 48 business hours, owners can utilize the following official alternative venues to request a manual review:

• Option A: The Norton Community Forums
  The community forum is actively monitored by Norton employees and serves as an effective route for standard account holders.
  • Procedure: Post a thread detailing your URL. State that you are a verified owner and that your portal submission has been pending for more than 48 hours. Staff moderators can manually pull the ticket from the backend queue for engineering review.
• Option B: Direct Norton Support (Paid Subscribers Only)
  An active, paid Norton subscription for personal or business security products allows owners to open a direct support ticket.
  • Procedure: Contact official support via live chat or phone. Inform the agent: “I have already submitted a site dispute via the Safe Web portal more than 48 hours ago and have not received a status update.” This specific phrasing allows the agent to route the ticket directly to the web security team.

[bjm]

@gebruiker60

HI We Have the same problem for our Website siltcon nl . Can you also help us?

We’ll try to call attention:
https://siltcon.nl/

Threat name: URL:Blacklist
URL: siltcon.nl
Detected by: Web Shield | URL scanning
Alert ID: aaaf564a964c

7a9d532503ae/2026-09-09T16:01:16.450Z

++++++++++++++++++++++++++++++++++++++++++++++

https://siltcon.nl/en

fc2b27106997/2026-09-09T16:20:37.087Z
16cfc9e2934f/2026-09-09T16:20:37.639Z
6af3fbdeb00a/2026-09-09T16:20:37.672Z

[bjm]

https://siltcon.nl/

AbuseIPDB » 23.227.38.65
We resolved the domain siltcon.nl to IP address 23.227.38.65
IP Abuse Reports for 23.227.38.65:
This IP address has been reported a total of 286 times from 58 distinct sources. 23.227.38.65 was first reported on November 20th 2025, and the most recent report was 17 hours ago.
Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.