Safari "Deceptive Website" warning on two of my legitimate sites — Google Safe Browsing is clean. How to get removed?

Question

Created 15h

Replies 1

Boosts 0

Participants 2

Two unrelated, legitimate websites I own are both shown as "Deceptive Website — Apple has identified this website as fraudulent" in Safari (iOS + macOS), and even inside my installed PWA on iOS. This is a false positive and I can't find a working way to get Apple to remove it.

Why I'm confident it's a false positive:

Google Safe Browsing site status: clean
Google Search Console (verified owner) > Security Issues: none
Yandex Webmaster > Security: no violations
VirusTotal: 0/92 detections
Chrome, Firefox, Yandex Browser: NO warning on any platform
Only Safari shows it, wording is "Apple has identified..." — i.e. Apple's own list, not the Google Safe Browsing feed

The sites are genuinely benign: no brand impersonation, no third-party credential harvesting, no malware, no drive-by downloads.

The interesting part — it's TWO unrelated sites:

Site A: a small web app (SaaS with a login form)
Site B: my personal developer portfolio — static, no login at all

They share almost nothing: different codebase, different design, different hosting (Site A is behind Cloudflare with a Google Trust Services edge cert; Site B is a plain nginx box with a Let's Encrypt cert), different TLS issuers, different stacks. The ONLY common denominator is me as the owner/registrant (same person, same contact email, same registrar account).

This makes me think the domains were clustered by registrant/owner rather than by anything on the sites themselves. The two-sites fact also rules out the usual scapegoats: it isn't Cloudflare (Site B isn't even on Cloudflare and is flagged too), nor the cert issuer, host, or stack, since those differ.

What I've already done:

Clicked "Report an error" on the Safari warning page
Submitted the Google Safe Browsing incorrect-warning report
Filed a tracked report in Feedback Assistant (FB number, status Open)
Hardened both sites anyway: CSP + security headers, SPF/DKIM/DMARC, and real trust pages (About with owner identity + contact, Privacy Policy, Terms, linked from homepage and login page)

It's been about a week with no response.

My questions:

When Google Safe Browsing is clean but Safari still flags, what feeds Apple's OWN fraudulent-site list? Is registrant/owner clustering a real mechanism here?
Which removal channel actually works in practice?
Realistic timeline for a false-positive removal?
If one domain is cleared, does that clear the owner-level association for the other, or do I appeal each separately?
Is there anything that re-triggers it? (Considering a domain migration as a last resort and want to avoid a new domain getting re-flagged.)

Any first-hand experience is appreciated — the process is completely opaque.

Answer 1

Etresoft OP

6h

The sites are genuinely benign: no brand impersonation, no third-party credential harvesting, no malware, no drive-by downloads.

The process isn't any kind of positive verification. By that I mean if your website did any of that, it would absolutely be reported and flagged. But the fact the website doesn't do any of that doesn't matter.

It's been about a week with no response.

You're never going to get a response. Consider how much fraud there is on the internet. Now consider the fact that you're underestimating that by several orders of magnitude. There is obviously not going to be any way to dispute these kinds of issues. Just move on.

The easiest solution is just to setup a new site with an unrelated name that you know to be valid. Use AWS, Azure, or some similar, household name service. Use their tools for all the pieces. Observe that it isn't flagged.

If you don't want to use those kinds of services, then there are still plenty of options. I don't let AWS handle my DNS, for example. But if you're going to take risks, then you may need to try things out with burner domain names first.