FortiGuard rates kveldeil.no and www.kveldeil.no as Malicious Websites - rating history shows no detection since 2016

Question

We host a Norwegian sports club website that FortiGuard classifies as Malicious Websites, High Risk, "strong confidence of malicious intent". We have submitted it three times through the Web Filter rating request form and each time received the same automated reply keeping the rating, with no evidence given. Hoping someone from FortiGuard Labs can take a look.

Domains: kveldeil.no and www.kveldeil.no - both have identical rating history.

Rating history, from your own Web Filter Lookup:

07 Dec 2016 - added as Malicious Websites

29 Mar 2017 - updated as Sports

23 Jan 2019 - removed as Sports

So the site was flagged in 2016, corrected to Sports in 2017, and in January 2019 the Sports rating was removed, which reverted it to the 2016 entry. There is no detection newer than December 2016 in the history. That suggests the current rating is inherited from old data rather than from anything recently observed.

What the site is: Kvelde Idrettslag, an amateur sports club. It runs on our CMS platform, which serves roughly 9,000 Norwegian club and association websites on shared infrastructure. The site contains only club news, calendars, event pages and membership forms.

What we checked: all scripts served are our own platform code; no iframes, no obfuscated content, nothing injected. HTTP 200 with HSTS, valid Let's Encrypt certificate, TLS 1.0 and 1.1 disabled. We probed 2,051 other domains on the same shared IP through the same filter and none were blocked, so this is specific to the domain, not the infrastructure.

Other vendors, this week: Dr.Web closed our report as a confirmed false alarm. alphaMountain rescanned and reclassified the site. Cisco Talos rates Web Reputation as Neutral for both hostnames. On VirusTotal, Google Safe Browsing, Kaspersky, ESET, Sophos and BitDefender all rate it clean.

What we are asking: if FortiGuard holds a specific detection - a URL or path, a sample hash, a date - please share it. If something is genuinely wrong on this site or on our platform, we want to find and fix it, and that matters more to us than the rating. Otherwise, please have an analyst review both hostnames.

Side note for whoever maintains the forms: the Malicious URL Appeal Form (/faq/malurl) and the WebFilter Contact Form (/faq/webfilter-contact) both fail with "ERROR: Something went wrong!" on every submission. The reCAPTCHA widget does not render on either page, so there is no token to submit. The rating request form at /faq/wfratingsubmit works fine.

osoleimani · Answer

Hi,Based on the information you've provided, I would continue this as a FortiGuard Web Filter classification/review request rather than a FortiGate configuration issue.The Web Filter rating is maintained by the FortiGuard Web Filtering service, and the appropriate process for an incorrectly classified website is to submit the domain through the FortiGuard Web Filter lookup and select Request a Review. Fortinet documents this process here:FortiGuard Web Filter Rating RequestFortinet's Community documentation also confirms that the Web Filter team reviews these requests and can change the rating when the classification is determined to be incorrect.Since you have already submitted the request multiple times without a change, I would include the information you provided here — particularly the rating history, the two hostnames, and the fact that both currently return the same classification — in the review request.If the review request continues to receive no response, I would recommend contacting Fortinet Support through an applicable support contract and referencing the existing Web Filter classification request so it can be followed up through the appropriate channel.The CAPTCHA/form issue you mentioned is also worth mentioning in the request, since it may prevent you from successfully submitting the required information.The important point is that the Web Filter classification itself is maintained by FortiGuard; it is not something that can be corrected by changing the FortiGate Web Filter profile.Hope this helps point you toward the appropriate review path.

Sign up

Login with SSO

Login to the community

Login with SSO