Website False Positive Been Waiting on Norton to fix 2 months now, HELP!

[user13898]

Website is giving false positive, and I cannot get anyone from Norton to help, myself and web developer have submitted multiple false positive reports and NOTHING. Should we just give up or is there some hack here?

[bjm]

@user13898

Website False Positive Been Waiting on Norton to fix 2 months now, HELP!
Website is giving false positive, and I cannot get anyone from Norton to help, myself and web developer have submitted multiple false positive reports and NOTHING.

Hello @user13898
Welcome to the Norton Community!

Understanding Norton - Site Re-Evaluations

Care to share website domain name / address (space name to break link)

[bjm]

Hello @user13898
Welcome to the Norton Community!

Understanding Norton - Site Re-Evaluations

Care to share website domain name / address (space name to break link)

[bjm]

Hello @user13898
Welcome to the Norton Community!

Understanding Norton - Site Re-Evaluations

Care to share website domain name / address (space name to break link)

[bjm]

Hello @user13898
Welcome to the Norton Community!

Understanding Norton - Site Re-Evaluations

We’ll try to call attention:
https://thecochranoriental.com/

Threat name: URL:Phishing
URL: thecochranoriental.com
Detected by: Web Shield | URL scanning
Alert ID: 20fc891232ab

2a937797a5d7/2026-09-28T11:03:30.160Z
610c812b2eaf/2026-09-28T11:24:47.827Z

++++++++++++++++++++++++++++++++++++++++++++++

f4623dbe05b2/2026-09-28T11:25:48.700Z

++++++++++++++++++++++++++++++++++++++++++++++

File: Session_13435067811818573
File size: 646 KB (661,309 bytes)
SHA256 checksum: 053FCB722616C646605B827FA524FCAC08ACB6815E20BBC103C22F749B95FE74
Date/Time: 9/28/2026

[bjm]

[Selvakumar.S]

Hi @user13898

Thank You for reporting the issue on Norton Community. The reported url is now resolved as False Positive. Could you please check now?

Thanks !

[bjm]

https://thecochranoriental.com/

998e29c24485/2026-09-28T12:40:08.612Z

[bjm]

https://thecochranoriental.com/

Threat name: JS:CardStealer-HS [Trj]
URL: thecochranoriental.com
Detected by: Web Shield | Content scanning

cc5790e27ffb/2026-09-28T13:13:35.680Z
274deba90fd8/2026-09-28T14:23:46.182Z

[bjm]

https://thecochranoriental.com/

Threat name: JS:CardStealer-HS [Trj]
URL: thecochranoriental.com
Detected by: Web Shield | Content scanning

992137cd40ba/2026-09-28T15:19:47.396Z

[bjm]

https://thecochranoriental.com/
+ 5 hours

Threat name: JS:CardStealer-HS [Trj]
URL: thecochranoriental.com
Detected by: Web Shield | Content scanning

92311e3bb5a6/2026-09-28T17:41:59.520Z

788e1343c1d7/2026-09-28T21:16:56.190Z

[user13912]

norton websage really needs to fix their bot detection
there is no reason why my site crm. collectivekindness. net is tagged as warning.
securi reports as having no isssues

[bjm]

@user13912

norton websage really needs to fix their bot detection
there is no reason why my site crm. collectivekindness. net is tagged as warning.
securi reports as having no isssues

Hello @user13912
Welcome to the Norton Community!

Understanding Norton - Site Re-Evaluations

We’ll try to call attention:
https://crm.collectivekindness.net/

https://crm.collectivekindness.net/login

Threat name: URL:Phishing
URL: crm.collectivekindness.net
Detected by: Web Shield | URL scanning
Alert ID: c1d0cddb32c2 | 7d048591ae19

d5b742aba452/2026-09-28T22:45:03.716Z
c93f518a194a/2026-09-28T23:04:10.715Z
ccc2ee213a94/2026-09-28T23:15:42.066Z

[Selvakumar.S]

Hi @user13912

Thank You for reporting the issue on Norton Community. The reported url is now resolved as False Positive. Could you please check now?

Thanks !

[bjm]

https://thecochranoriental.com/

2a61f9dfcfb5/2026-09-29T10:17:15.702Z

[bjm]

https://thecochranoriental.com/

69ada0427109/2026-09-30T00:11:53.722Z
def1b78d9435/2026-09-30T00:11:55.016Z
def1b78d9435/2026-09-30T00:11:55.016Z
d89a25f2fd5c/2026-09-30T00:11:55.086Z
08548d503a5d/2026-09-30T00:11:55.130Z
3146bef9da02/2026-09-30T00:11:55.219Z

https://thecochranoriental.com/wp-content/plugins/elementor/assets/lib/swiper/v8/c
ss/swiper.min.css?ver=8.4.5

This URL points to a minified Cascading Style Sheet (CSS) file for Swiper, a popular open-source JavaScript library used for creating mobile-touch sliders, carousels, and swipable galleries on websites.

Specifically, this file is being loaded by Elementor, a widely used website builder plugin for WordPress.

A “URL:CardStealer” flag from Norton Safe Web indicates that the security software believes the website is injected with a credit card skimmer script (malicious code designed to steal payment data during checkout).

Whether you are a visitor or the site owner, this specific flag on an Elementor file (swiper.min.css) means one of two things:

Scenario 1: The Site is Actually Compromised (High Probability)
WordPress sites using page builders like Elementor are frequently targeted by automated attacks. Hackers often compromise a site and inject malicious redirect or stealing scripts into standard, unsuspecting core files—like a CSS or JavaScript file—so they can load silently across the entire site without raising immediate suspicion.

Scenario 2: It is a False Positive
Antivirus programs rely on heuristics and signature matching. Occasionally, an over-aggressive signature update flags a completely clean, standard open-source library asset (like Swiper CSS) by mistake.

AI sourced content may make mistakes

https://sitecheck.sucuri.net/results/https/thecochranoriental.com

[user13898]

This is from my developer, I sent this to Norton, you saying we still have problems?

Subject: Request re-review - the cochran oriental

Hello Norton Safe Web Team,

We are requesting a re-review of our website:

The site was previously flagged as URL:CardStealer.

We have investigated and fully remediated the issue.

Actions completed:

• Identified and removed malicious JavaScript that

had been injected into our checkout page. It was

loading an external script from a third-party

domain that we do not control.

• The injection was stored in our website database,

not in a file, which is why file-based scans did

not detect it. It has been fully removed.

• Removed the outdated payment plugin that was the

original point of entry. It had been withdrawn

from the WordPress plugin repository.

• Replaced it with the official Authorize Net

payment plugin.

• Updated WordPress core, all plugins and the theme.

• Reset all administrator passwords and invalidated

all active login sessions.

• Enabled two-factor authentication for all

administrator accounts.

• Removed publicly accessible backup files from the

web root.

• Ran full malware scans at server level, which

return clean.

We have verified that the checkout page no longer

loads any unauthorised external scripts.

Please re-scan the site and remove the warning.

Thank you,

[SoulAsylum]

@user13898 Has your developer looked at this CVE? # CVE-2026-27212

NVD - Home

SA

[bjm]

@user13898

We have investigated and fully remediated the issue.
We have verified that the checkout page no longer loads any unauthorized external scripts.
Please re-scan the site and remove the warning.

Hello @user13898
fwiw ~ my understanding = thecochranoriental.com is under internal review.
Hopefully, we’ll hear back soon.

[bjm]

Threat name JS:CardStealer-HS [Trjl
Threat type Trojan Horse - This threat pretends to be something else (e.g., picture, document, or other file) to trick you into running it and infecting your computer.
URL https://thecochranoriental.com/
56463aae6e58/2026-09-30T10:56:16.023Z

Threat blocked - Phishing
This is a scam designed to steal sensitive information like your credit card number, banking credentials, or passwords.
Threat name: JS:CardStealer-HS [Trj]
URL: thecochranoriental.com
Detected by: Web Shield | Content scanning

JS:CardStealer-HS [Trj] is a specific detection name used by Norton Safe Web (and related Norton products like Norton 360) to flag websites that are suspected of hosting Magecart-style digital skimmers designed to steal customer credit card details during checkout.

This detection often results in false positives for legitimate e-commerce sites, particularly those using real-time security monitoring tools (such as Sansec ) that hook into payment forms to prevent fraud; Norton’s heuristic engine may misinterpret these defensive scripts as malicious data-stealing code.

• Detection Logic: Norton uses AI and URL filtering to identify scripts that intercept form submission fields on payment pages.
• Common Confusion: Legitimate security hooks that monitor checkout fields look identical to malicious skimmers to automated scanners.

AI sourced content may make mistakes

fwiw ~ Sucuri free tool Re-scan = Malware Detected