Two unrelated, legitimate websites I own are both shown as "Deceptive
Website — Apple has identified this website as fraudulent" in Safari (iOS +
macOS), and even inside my installed PWA on iOS. This is a false positive and
I can't find a working way to get Apple to remove it.
Why I'm confident it's a false positive:
Google Safe Browsing site status: clean
Google Search Console (verified owner) > Security Issues: none
Yandex Webmaster > Security: no violations
VirusTotal: 0/92 detections
Chrome, Firefox, Yandex Browser: NO warning on any platform
Only Safari shows it, wording is "Apple has identified..." — i.e. Apple's
own list, not the Google Safe Browsing feed
The sites are genuinely benign: no brand impersonation, no third-party
credential harvesting, no malware, no drive-by downloads.
The interesting part — it's TWO unrelated sites:
Site A: a small web app (SaaS with a login form)
Site B: my personal developer portfolio — static, no login at all
They share almost nothing: different codebase, different design, different
hosting (Site A is behind Cloudflare with a Google Trust Services edge cert;
Site B is a plain nginx box with a Let's Encrypt cert), different TLS
issuers, different stacks. The ONLY common denominator is me as the
owner/registrant (same person, same contact email, same registrar account).
This makes me think the domains were clustered by registrant/owner rather
than by anything on the sites themselves. The two-sites fact also rules out
the usual scapegoats: it isn't Cloudflare (Site B isn't even on Cloudflare
and is flagged too), nor the cert issuer, host, or stack, since those differ.
What I've already done:
Clicked "Report an error" on the Safari warning page
Submitted the Google Safe Browsing incorrect-warning report
Filed a tracked report in Feedback Assistant (FB number, status Open)
Hardened both sites anyway: CSP + security headers, SPF/DKIM/DMARC, and
real trust pages (About with owner identity + contact, Privacy Policy,
Terms, linked from homepage and login page)
It's been about a week with no response.
My questions:
When Google Safe Browsing is clean but Safari still flags, what feeds
Apple's OWN fraudulent-site list? Is registrant/owner clustering a real
mechanism here?
Which removal channel actually works in practice?
Realistic timeline for a false-positive removal?
If one domain is cleared, does that clear the owner-level association for
the other, or do I appeal each separately?
Is there anything that re-triggers it? (Considering a domain migration as
a last resort and want to avoid a new domain getting re-flagged.)
Any first-hand experience is appreciated — the process is completely opaque.