Thanks for your comments bjm, I don’t know if any Norton webmaster also reads the tthreads on this forum but we like to further clarify the Sucuri results. I’m afraid that it’s being read as a detection and it isn’t one.
On the sentoa.cloud report, SiteCheck states “Site is not Blacklisted — 9 blacklists checked”. The “Medium Security Risk” needle is what SiteCheck shows when its scan cannot run, and the reason is printed on the same page: “Unable to scan your site. 426 Upgrade Required” and “Site empty (no content)”. That is a protocol-level failure of their scanner, not a malware finding. We verified from three different clients — HTTP/1.0, HTTP/1.1, and using Sucuri’s own user agent string, that our server returns HTTP 200 with normal content.
More usefully, Sucuri’s scanner completed successfully against the other two hostnames:
- app.sentoa.cloud — “No Malware Found”, “Site is not Blacklisted” (9 blacklists checked), Low Security Risk
- api.sentoa.cloud — “No Malware Found”, “Site is not Blacklisted” (9 blacklists checked), Low Security Risk
Independent checks across all three:
- VirusTotal, 18 September 2026: 0 of 90 engines flag sentoa.cloud
- Google Safe Browsing, last updated 16 September 2026: “No unsafe content found”
- Sucuri: not listed on any of the 9 blocklists it checks, for any of the three hostnames
For completeness, and stated plainly: our WordPress site was genuinely compromised on 8 September 2026. A ClickFix/EtherHiding loader was injected into a single theme file and served a fake verification page to desktop visitors. Norton’s original detection was correct and we are not disputing it.
The injected file was removed the same day at 21:33 CEST, roughly seven hours after it appeared. A full scan of 20,251 files on 9 September found no malware, no unknown files, and no modified core, plugin or theme files. The stolen administrator credential was rotated, two-factor authentication enabled, the WordPress file editor disabled, and all plugins and the theme updated.
app.sentoa.cloud and api.sentoa.cloud are a React application and its API, hosted on 9.163.87.240 — a different server from the WordPress site on 188.208.36.198. Neither was ever compromised, and both now scan clean. The flagged file at app.sentoa.cloud/sw.js is an unmodified Workbox-generated service worker and can be inspected directly.
Three false-positive reports were submitted on 8 September 2026. Safe Web still shows the warning and we have seen no re-crawl since 10 September. Could someone please trigger a re-scan of sentoa.cloud, app.sentoa.cloud and api.sentoa.cloud?
The practical impact is that customers running Norton cannot use our product. Because a service worker re-checks for updates on every page load, each affected user receives the alert repeatedly, one reported 19 alerts in a single session.
