Site flagged (false positive), but nothing changed and its safe! Please review

[Carl_Cox1]

Issue abstract: Site flagged (false positive), but nothing changed and its safe! Please review. Note: We submitted a dispute, but need this fixed quickly.

Detailed description: Our site khm.agency is flagged as Warning (false positive)

Product & version number: Norton Safeweb

What is the error message you are seeing?

[bjm]

• Norton Submission Portal is used for submitting false positive reports.
• Verified site owners generally have access to a dashboard where they can see the status of their site and any pending disputes.
• If the status of your site has not changed – on the Safe Web public lookup – after 48 business hours – contact official Norton Support directly. Explicitly tell the agent: “I have already submitted a site dispute via the Safe Web portal more than 48 hours ago and have not received a status update.” This often prompts support to escalate the ticket manually.

• Norton Submission Portal does not send automated confirmation or status update emails, even when an email address is provided.
  If the review determines the detection was indeed a false positive, Norton typically releases updated definitions to address it within 48 hours without specifically notifying the submitter.

Submitting through the official portal at submissions.norton.com evaluates only the specific URL path you type into the box. It will not trigger a domain-wide rescan.
Domain-wide rescan request can only be triggered by the site owner who has verified their site.

False detection reported through a “Threat Secured” notification popup is strictly path-specific.

By forcing owners to go through the Norton Safe Web Owner Portal and place a cryptographic meta tag into the website’s HTML, Norton filters out general traffic noise. This verification ensures that a real human analyst or a resource-heavy, top-to-bottom structural recursive domain crawl (/*) is only deployed for authenticated administrators who legally control the domain platform.

A public guest submission is simply an automated single-point string fix. Only a verified site owner filing an official site dispute can break through that automation to clear an entire domain tree.

• Unverified Public Submissions resolve symptoms (individual web links).
• Verified Owner Site Disputes resolve the root cause (the entire domain-wide wildcard status).

[bjm]

https://khm.agency/

Threat name: URL:Blacklist
URL: khm.agency
Detected by: Web Shield | URL scanning
Alert ID:3a6f71a34e1b
Alert ID: 05c55cbdf84e

fedd52ac76fc/2026-07-29T19:53:43.797Z
be79c4c161cf/2026-07-29T20:12:12.278Z

fedd52ac76fc/2026-07-29T19:53:43.797Z
be79c4c161cf/2026-07-29T20:12:12.278Z

[bjm]

https://khm.agency/

https://www.virustotal.com/

https://sitecheck.sucuri.net/

https://www.abuseipdb.com/
We resolved the domain khm.agency to IP address 52.137.90.183
IP Abuse Reports for 52.137.90.183
This IP address has been reported a total of 3 times from 2 distinct sources. 52.137.90.183 was first reported on November 23rd 2022, and the most recent report was 2 years ago.
Old Reports: The most recent abuse report for this IP address is from 2 years ago. It is possible that this IP is no longer involved in abusive activities.

[bjm]

https://khm.agency/