Possible increase in false positive “Fraudulent Website Warning” detections in Safari (2026)

Question

Created 12h

Replies 2

Boosts 1

Participants 2

Hello Apple engineers and fellow developers,

Over the past few weeks I have noticed multiple reports from different developers whose legitimate websites have been classified by Safari as “Fraudulent Website Warning”, despite passing every major public security and reputation check.

My websites appear to be affected by the same issue.

Domains

https://skvoz.net
https://skvoz.org

Both domains were registered on July 15, 2026.

The Fraudulent Website Warning first appeared on July 22, 2026, only one week after registration.

Both websites are legitimate services operated by our team.

Neither website impersonates another brand, attempts to collect Apple IDs, banking credentials, passwords, or any other sensitive information through deceptive means.

Extensive verification performed

After the warning appeared, we performed a comprehensive technical and security review.

Website security

✅ No malware detected
✅ No phishing content
✅ No unauthorized redirects
✅ No suspicious JavaScript
✅ No mixed-content issues
✅ HTTPS configured correctly
✅ Valid TLS certificates

Infrastructure

DNS configuration verified
SSL certificate chain verified using OpenSSL
Server responds correctly over HTTP/2
IPv4 and IPv6 connectivity verified
Origin server behaves correctly
Cloudflare configuration was thoroughly tested during troubleshooting and ultimately removed from the production setup to eliminate it as a possible cause

Reputation checks

We verified both domains and the hosting IP address using multiple public reputation services.

Results were consistently clean.

This included services such as:

Google Safe Browsing
Google Search Console
VirusTotal
URLVoid
IP reputation databases

None of them currently report malware, phishing activity, or any other security issues.

Apple-specific actions

We have already:

submitted a Website Review request;
contacted Apple Security via reportphishing @apple.com requesting a manual review.

At the time of writing, the warning is still present.

One unusual observation

One particularly unusual observation is that both of our domains (skvoz.net and skvoz.org) received the warning independently.

These are separate domains serving different purposes, yet both appear to have been classified in the same way despite passing the same technical and reputation checks.

This made me wonder whether Apple’s reputation system may evaluate related domains or shared infrastructure together. I understand the internal implementation is not public, but I wanted to mention this observation in case it is useful during investigation.

Similar reports

While investigating this issue, I found several recent reports from other developers describing almost identical behavior.

The common pattern is remarkably consistent:

Safari displays Fraudulent Website Warning
Chrome, Firefox and Edge open the website normally
Google Safe Browsing reports the domain as safe
VirusTotal reports no malware
Google Search Console reports no security issues
valid HTTPS certificates
relatively new domains
no explanation regarding what triggered the warning

This suggests the issue may not be isolated to a single website.

Questions

I would greatly appreciate any guidance from Apple engineers.

Does Safari rely solely on Google Safe Browsing, or does Apple maintain an independent reputation database for Fraudulent Website Warning?
If Apple maintains its own reputation system, are there any documented technical signals developers should verify?

For example:

redirects
third-party scripts
TLS configuration
domain age
hosting reputation
infrastructure characteristics
phishing heuristics
machine-learning based classification

Is there any recommended diagnostic process beyond Website Review?
Approximately how long does a manual review usually take?

Why I am posting

This post is not only about my own websites.

Over the past few months I have noticed an increasing number of developers reporting what appear to be false positive Fraudulent Website Warnings affecting legitimate websites.

If there have been recent changes to Safari’s reputation or anti-phishing systems, it would be extremely helpful for developers to better understand what technical criteria should be reviewed before requesting reconsideration.

Even if the exact detection logic cannot be disclosed, any general guidance on common causes of false positives would help developers resolve issues much more efficiently.

Thank you very much for your time.

Answer 1

ntsurkan OP

7h

Same problem here, with two domains.

Timeline

lastfix.app went live around July 12, 2026. Safari began showing the “Deceptive Website” warning shortly after. I moved the product to a new domain, lastfix.video, on July 24. It was flagged as well. A detail that may be relevant to others here: the verdict appears to follow redirects.

During the migration I left a 301 from lastfix.app to lastfix.video. The new domain picked up the warning almost immediately, despite having no history of its own — it had existed for hours. I have since replaced the redirect with a static page containing an ordinary link instead. If anyone else in this thread migrated domains with a redirect in place, that may explain why their second domain was flagged too.

Same verification results as yours

Google Search Console: no security issues on either domain. Google Safe Browsing Transparency Report: no unsafe findings for either domain. Chrome opens both domains without any warning. Only Safari warns. Valid Let’s Encrypt certificates on both, correct chains. Regarding your first question — yes, Apple maintains an independent list.

Safari stores the Safe Browsing data it downloads under two separate provider directories, one for Google and one for Apple, each containing its own threat lists. The Apple directory has its own social_engineering list, distinct from Google’s. So a domain can be listed by Apple while every Google list is clean. That is precisely what “Google reports safe, Safari warns” looks like from the outside, and it means checking Google Safe Browsing tells you nothing about the Apple verdict.

Same pattern you describe

Both of my domains were newly registered. Both were flagged within roughly one to two weeks of going live. Nothing about the content changed between the clean period and the warning appearing.

Not all users see the warning — roughly half of the people I asked do, on different networks and devices. That is consistent with the list propagating to devices gradually rather than a per-device or per-network cause.

I am preparing a Website Review submission now. Has anyone here had one actually resolved, and roughly how long did it take? Even a rough expectation would help.

Answer 2

ntsurkan OP

2h

I have a theory, and given the current situation it looks quite realistic. I checked the DNS:

skvoz.net → 89.169.35.79 (AS210644)
skvoz.org → 91.184.241.229 (AS210644)
lastfix.app → 5.182.87.37 (AS210644)
lastfix.video → 5.182.87.37 (AS210644)

AS210644 = AEZA-AS, AEZA GROUP LLC, RU

We are both hosted on Aeza, and it turns out that since 2025 Aeza has been under sanctions: https://www.chainalysis.com/blog/ofac-sanctions-aeza-group-bulletproof-hosting-crypto-payments-july-2025/

I'm afraid that in this case support won't even do anything, since they are not allowed to work with companies on the sanctions list. The only option I see is to move to a different, "clean" provider and get new domains. And in parallel, keep trying to reach support to get the domains removed from those lists. This looks extremely sketchy and ugly from every angle, because I only just found out that our hosting provider is a bulletproof hosting operation and, on top of that, is under sanctions. And what's being blocked isn't the provider itself - it's our new domains. I don't think this is a coincidence - most likely this is exactly the cause.