Safari "Deceptive Website" warning on a domain that is clean in Google Safe Browsing — how is the Apple-side list reviewed?

Question

Created 9h

Replies 1

Boosts 0

Participants 2

My site formtracker.ru shows Safari's "Deceptive Website" warning. I believe it is a false positive, and I am trying to understand how the Apple-side check is reviewed, since every other signal I can measure is clean.

What the site is A strength-training tracker that runs as a Telegram Mini App. There is no login form, no payment form, and no field anywhere that asks a visitor for credentials, card details or personal data — authentication happens inside Telegram, not on the page. The site does not imitate any brand or product; all content is our own. Privacy policy and terms are published at /privacy.html and /terms.html with a working contact address.

What I verified

Google Safe Browsing: clean
VirusTotal: no detections
Chrome, Firefox and other browsers on the same device: no warning
The warning appears only in Safari

One reproducible observation After migrating hosting I created a brand-new subdomain that had never been published, linked or crawled anywhere, pointing at the new IP. Safari flagged it immediately on first load. That strongly suggests the entry applies to the registrable domain and all of its subdomains rather than to a specific URL or IP — and therefore that nothing I change on my side (hosting, content, subdomain) can clear it.

Possible contributing factor, already removed Until 19 Aug 2026 the site was hosted at 79.137.205.96. That address sits inside a range listed by Spamhaus SBL under a "bulletproof hosting" classification. The listing covers the whole /24 and the neighbouring /24s, including addresses unrelated to my service, so it was not specific to me; AbuseIPDB has zero reports for that address. I have since moved to a different provider entirely, and the current IP is clean in Spamhaus ZEN, Barracuda, SpamCop and SORBS. I am not claiming this was the cause — I have no way to know. It is simply the one negative signal I could find and verify, and it no longer applies.

What I have already submitted

"Report an Error" from the Safari warning screen
The Fraudulent Website Warning review request form
Feedback Assistant: FB24430497

One more detail The warning also appears with the device region set to Germany, so it does not appear to be region-specific.

My questions

Is there a review channel for the Apple-side list other than the three above, and is there any way to tell whether a submission was received at all?
Since a never-published subdomain was flagged on first load, is the entry expected to apply to the whole registrable domain? If so, is a domain-level review the only path?
Has anyone here had a Safari-only false positive cleared, and roughly how long did it take?

I am happy to provide anything else that would help — full URLs, screenshots, timestamps.

Answer 1

Etresoft OP

6h

There is no login form, no payment form, and no field anywhere that asks a visitor for credentials, card details or personal data — authentication happens inside Telegram, not on the page. The site does not imitate any brand or product; all content is our own. Privacy policy and terms are published at /privacy.html and /terms.html with a working contact address.

Nobody cares about any of that or will ever look at it.

Google Safe Browsing: clean

Doesn't matter.

VirusTotal: no detections

LOL!

Chrome, Firefox and other browsers on the same device: no warning

So publish your apps on those platforms then.

The warning appears only in Safari

Typical response in these cases is to just blame Apple for some bug or wrong-doing and write a blog post about it. Or would you rather solve the problem and prevent it in the first place? Now that's a radical approach.

After migrating hosting I created a brand-new subdomain that had never been published, linked or crawled anywhere, pointing at the new IP. Safari flagged it immediately on first load. That strongly suggests the entry applies to the registrable domain and all of its subdomains rather than to a specific URL or IP — and therefore that nothing I change on my side (hosting, content, subdomain) can clear it.

That seems likely. Furthermore, you should consider that domain name to be dead. It may be possible to resurrect, but I don't know.

What I have already submitted "Report an Error" from the Safari warning screen The Fraudulent Website Warning review request form Feedback Assistant: FB24430497

Apple certainly loves feedback. Doesn't mean they'll do anything about it. Generally speaking, if this is a problem that only affects you, and not Apple, then you're on your own.

Is there a review channel for the Apple-side list other than the three above, and is there any way to tell whether a submission was received at all?

You can be confident that it was received.

Since a never-published subdomain was flagged on first load, is the entry expected to apply to the whole registrable domain? If so, is a domain-level review the only path?

There is no path. You've reached a dead end here.

Has anyone here had a Safari-only false positive cleared, and roughly how long did it take?

Probably the single most annoying request in this forum - the appeal to anyone else who has had this problem. What do you expect to get out of this request? I saw a virtually identical post 3 days ago. Didn't you? Does it matter? I assure you, it does not.

I am happy to provide anything else that would help — full URLs, screenshots, timestamps.

None of that matters in the least.

Here's what you do...

Recognize that you're talking ".ru". This is the world as it is. It's working very much "as designed".

When you find a nice web host, register a throwaway domain name. Check it in Safari. If it fails, find a new host. Repeat until Safari is happy. Ideally pick a nice, Apple-friendly host like AWS or Azure. I recognize that may be problematic for .ru, but such is the state of the world. Maybe try avoiding the ".ru" domain. Maybe that helps.

Once you're confident that you have a workable stack from host to DNS, try your real domain name. Hopefully that works.