Home / Blog / Webroot False Positives: Three Clean Sites Rated as Phishing

False Positives

Webroot False Positives: Three Clean Sites Rated as Phishing

27 October 2026 · By John Carlsson

BrightCloud, the database behind Webroot, rates aiwebpageseo.store, aiwebpageseo.shop and aiwebpageseo.info as High Risk phishing with one infection each. The sites have no forms, no downloads and no hidden code, 54 or more other security vendors rate them clean, and BrightCloud rates near-identical copies of the same pages as Computer and Internet Info.

On 27 October 2026 I found that BrightCloud, the OpenText database behind Webroot, lists three of my sites as High Risk in the category Phishing and Other Frauds. The sites are aiwebpageseo.store, aiwebpageseo.shop and aiwebpageseo.info. All three are single-page sites built from my main site, aiwebpageseo.com, and they describe and link to free SEO, AEO and schema audit tools.

That rating does not stay inside Webroot. Other reputation services copy it. Gridinsoft now calls aiwebpageseo.shop a "Malware Distributor" on the strength of it, and ScamAdviser takes Gridinsoft's data feed. One entry in one database is being repeated across the internet as a statement that my business is a fraud.

This post sets out every statement BrightCloud makes about these three sites, the facts, and the links that prove them. Anyone can check every link for themselves.

What BrightCloud says

BrightCloud lists all three domains with exactly the same verdict (database version 9.926, 27 October 2026):

Web Reputation: High Risk (10 of 100)
Web Category: Phishing and Other Frauds
Influences: 1 infections (past 12 months), Low popularity, 1 months old (not established)

You can check this yourself with the BrightCloud URL lookup.

Statement 1: "High Risk (10 of 100)"

On VirusTotal, Webroot is the only vendor out of 92 flagging aiwebpageseo.store. 54 vendors report it clean, including Google Safe Browsing, Kaspersky, ESET, Sophos, BitDefender and Fortinet. VirusTotal: aiwebpageseo.store

aiwebpageseo.shop is reported clean by 55 vendors, including URLhaus and VX Vault, which exist to track malware distribution sites. VirusTotal: aiwebpageseo.shop

Gridinsoft lists the Webroot rating as the only warning against aiwebpageseo.info and describes the site as showing "no major malware/phishing detections". VirusTotal: aiwebpageseo.info and Gridinsoft: aiwebpageseo.info

ScamAdviser rates aiwebpageseo.shop 100 ("Very Likely Safe"), aiwebpageseo.info 95 ("Very Likely Safe") and aiwebpageseo.store 76 ("Likely Safe"), all from fresh scans on 27 October 2026. ScamAdviser: .shop, ScamAdviser: .info and ScamAdviser: .store

Google Safe Browsing reports no unsafe content on any of them. Google: .store, Google: .shop and Google: .info

My main site, aiwebpageseo.com, which all three are built from, is flagged by 0 of 92 vendors on VirusTotal. Webroot itself rates it Clean. VirusTotal: aiwebpageseo.com

Statement 2: "Phishing and Other Frauds"

None of the three home pages has a form, a login, a payment page, an iframe or any means of collecting data. Phishing is not possible on these pages.

The pages contain no redirects and no link shorteners. The only external scripts load from my own main site, aiwebpageseo.com.

The sites describe and link to free SEO, AEO and schema audit tools. The correct category is Computer and Internet Info. See for yourself: aiwebpageseo.store, aiwebpageseo.shop and aiwebpageseo.info

Statement 3: "1 infections (past 12 months)"

BrightCloud records exactly one infection on each of three separate domains, with no detail of what was found, where or when.

I checked every file on all three sites on my server on 27 October 2026. They contain only my own pages, images, fonts, a cookie consent script and text files for AI crawlers.

There are no executables, installers, archives or server scripts (.exe, .msi, .zip, .rar, .7z, .apk, .dmg, .bat, .scr or .php) on any of the three sites. The home pages contain no hidden or obfuscated code (eval, atob, unescape or fromCharCode).

No infection has ever existed on any of these domains.

Statement 4: "1 months old (not established)"

All three domains were registered on 20 February 2026, eight months before the lookup. BrightCloud's own WHOIS section on the same lookup page shows the creation date 2026-02-20.

Statement 5: "Low popularity"

These are small single-page sites that support my main site. Low traffic is not evidence of fraud, and it does not justify a High Risk or phishing rating.

BrightCloud contradicts itself

My other satellite sites are built from the same main site, are near-identical to these three (up to 97.6% the same once the domain names are ignored) and were registered within a day of them. BrightCloud rates them very differently:

aiwebpageseo.co.uk: Moderate Risk (59 of 100), Computer and Internet Info, no infections in the past 12 months
aipageseo.com: Moderate Risk (60 of 100), Computer and Internet Info, no infections in the past 12 months
aipageseo.co.uk: Moderate Risk (59 of 100), Computer and Internet Info, no infections in the past 12 months
aiwebpageseo.store, aiwebpageseo.shop and aiwebpageseo.info: High Risk (10 of 100), Phishing and Other Frauds, 1 infection each

The same pages cannot be Computer and Internet Info on one domain and Phishing and Other Frauds on another. The only difference between them is the domain ending: .store, .shop and .info.

Identical verdicts, an identical "infection" and an identical wrong age on three separate domains show that these sites were classified as a batch, without anyone looking at them.

How one wrong entry spreads

Webroot's verdict on VirusTotal comes from BrightCloud. Gridinsoft counts it as an external warning, and on 27 October 2026 labelled aiwebpageseo.shop a "Malware Distributor" with a trust score of 1 out of 100, describing fake installers and cracks that do not exist anywhere on the site. Gridinsoft: aiwebpageseo.shop

ScamAdviser uses Gridinsoft's data feed. Gridinsoft's own partner page says "ScamAdviser leverages our real-time data feeds to warn users of online fraud." Gridinsoft partners

So a single unchecked entry, with a wrong domain age and an infection nobody can describe, ends up shown to the public by several services as proof that a small business is a phishing and malware operation.

BrightCloud is happy to tell the world that my sites could be phishing, could be fraud and could carry an infection, without a single piece of evidence. By the same standard, their rating could be malicious. I do not know whether this is negligence or something worse, but the effect on my business is the same: my sites have been publicly branded as phishing and fraud without a shred of proof, and my reputation has been seriously damaged.

What I have asked BrightCloud to do

I have submitted change requests for all three domains and asked BrightCloud to:

Reclassify all three domains to Computer and Internet Info and remove the High Risk rating.
Provide full details of the alleged infection on each domain, including the URL, the date and what was detected.
Confirm in writing when this has been done.

I can provide full server file listings, scan output and proof of ownership to BrightCloud on request. I will update this post with their reply.

If your site has been flagged

If BrightCloud or Webroot has flagged your site, look it up with the BrightCloud URL lookup and request a change with the BrightCloud change request form. The form only allows 150 characters, so put your full evidence on a page you control and link to it.

Check your site against every vendor at once on VirusTotal before you write to anyone. If one vendor out of 92 flags you and the rest say clean, that is a strong sign of a false positive. - 27 October 2026, 11:21 GMT: three change requests submitted on the BrightCloud change request form, one each for aiwebpageseo.shop, aiwebpageseo.store and aiwebpageseo.info, each linking to this post.

27 October 2026, 11:21 GMT: a formal data protection request sent by email to the OpenText Data Protection Officer under the UK GDPR and the EU GDPR (Articles 15, 16, 19, 21 and 22), asking for the details of the alleged infections, correction of the ratings and human review.
10 November 2026: the 14 days I have given BrightCloud to correct the rating and category of all three domains run out.
27 November 2026: the one month OpenText has under Article 12(3) of the UK GDPR to respond in full runs out. If no full response is received, I will complain to the Information Commissioner's Office.

27 October 2026, 11:31 GMT: the full request, with every statement, the facts, the links and the data protection requests, sent by email to the BrightCloud and Webroot database change team at OpenText (wr-dbchange@opentext.com), after their reply to the change requests gave that address.

All times are taken from the email time stamp.

Frequently asked questions

Why does Webroot flag a website as phishing when it is clean?

Webroot uses BrightCloud's reputation database, and BrightCloud rates domains with automated systems that weigh things such as domain age, the domain ending, popularity and links to other domains. A site can be rated High Risk or placed in Phishing and Other Frauds without anyone looking at its pages. In this case three near-identical single-page sites with no forms, no downloads and no hidden code were classified as phishing, while copies of the same pages on other domains were rated Computer and Internet Info.

How do I check what Webroot and BrightCloud say about my website?

Enter your domain into the BrightCloud URL lookup at brightcloud.com/tools/url-ip-lookup.php. It shows the web reputation score out of 100, the web category and the influences behind the rating, such as infections in the past 12 months, popularity and domain age. Then check the same domain on VirusTotal, which lists the verdict of Webroot alongside more than 90 other security vendors, so you can see whether Webroot is the only one flagging your site.

How do I get a Webroot false positive removed?

Submit a change request on BrightCloud's form at brightcloud.com/tools/change-request.php for each affected domain, and use the option to suggest the correct category. The comments box only allows 150 characters, so publish your full evidence on a page you control and put the link in the comment. Include your VirusTotal results, a list of what is actually on the site and proof that you own the domain, and ask for the details of any infection they claim to have found.

Does a Webroot rating affect other reputation sites?

Yes. Webroot's verdict appears on VirusTotal, and other services count it as an external warning. Gridinsoft used Webroot and three other minority verdicts to label one of these sites a Malware Distributor with a trust score of 1 out of 100, and ScamAdviser takes Gridinsoft's data feed. One wrong entry in BrightCloud's database can therefore spread across several sites that the public use to decide whether a business is safe.